Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CWE-476 In /tcmu-runner/file_zbc.c:117:37 #690

Open
gorsing opened this issue Dec 21, 2022 · 0 comments
Open

CWE-476 In /tcmu-runner/file_zbc.c:117:37 #690

gorsing opened this issue Dec 21, 2022 · 0 comments

Comments

@gorsing
Copy link

gorsing commented Dec 21, 2022

Hi
Perhaps now is the time to add static analysis to your code.

now a new version of the code and it is gradually getting even better.
Exemple global enable GCC Static Analysis

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 9276f4d..2f98f89 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,7 +1,7 @@
 cmake_minimum_required (VERSION 2.8 FATAL_ERROR)
 project (tcmu-runner C)
 set(VERSION 1.6.0)
-set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Werror -Wall -Wdeclaration-after-statement -std=c99")
+set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Werror -Wall -fanalyzer -fanalyzer-verbosity=4 -Wdeclaration-after-statement -std=c99")

Or a light way
add those directives from the list that don't trigger the GCC Static Analysis alert now

When adding new commits, there will be a check in the development process, there will be no new problems

-Wanalyzer-double-fclose 
-Wanalyzer-double-free 
-Wanalyzer-exposure-through-output-file 
-Wanalyzer-file-leak 
-Wanalyzer-free-of-non-heap 
-Wanalyzer-malloc-leak 
-Wanalyzer-possible-null-argument 
-Wanalyzer-possible-null-dereference 
-Wanalyzer-null-argument 
-Wanalyzer-null-dereference 
-Wanalyzer-stale-setjmp-buffer 
-Wanalyzer-tainted-array-index 
-Wanalyzer-unsafe-call-within-signal-handler 
-Wanalyzer-use-after-free 
-Wanalyzer-use-of-pointer-in-stale-stack-frame
/tcmu-runner/file_zbc.c:117:37: error: dereference of NULL ‘zone’ [CWE-476] [-Werror=analyzer-null-dereference]
  117 | #define zbc_zone_conv(z)        ((z)->type == ZBC_ZONE_TYPE_CONVENTIONAL)
      |                                  ~~~^~~~~~
/tmp/tcmu-runner/file_zbc.c:120:35: note: in expansion of macro ‘zbc_zone_conv’
  120 | #define zbc_zone_seq(z)         (!zbc_zone_conv(z))
      |                                   ^~~~~~~~~~~~~
/tmp/tcmu-runner/file_zbc.c:2134:21: note: in expansion of macro ‘zbc_zone_seq’
 2134 |                 if (zbc_zone_seq(zone) && !zbc_zone_is_open(zone)) {
      |                     ^~~~~~~~~~~~
  ‘zbc_write’: event 1
    |
    | 2102 | static int zbc_write(struct tcmu_device *dev, struct tcmulib_cmd *cmd)
    |      |            ^~~~~~~~~
    |      |            |
    |      |            (1) entry to ‘zbc_write’
    |
  ‘zbc_write’: event 2
    |
    |cc1:
    | (2): 
    |
  ‘zbc_write’: events 3-5
    |
    | 2104 |         struct zbc_dev *zdev = tcmur_dev_get_private(dev);
    |      |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                                |
    |      |                                (3) ...to here
    |      |                                (4) stmt: zdev_67 = tcmur_dev_get_private (dev_65(D));
    |......
    | 2118 |         ret = zbc_check_rdwr(dev, cmd);
    |      |               ~~~~~~~~~~~~~~~~~~~~~~~~
    |      |               |
    |      |               (5) calling ‘zbc_check_rdwr’ from ‘zbc_write’
    |
    +--> ‘zbc_check_rdwr’: event 6
           |
           | 1883 | static int zbc_check_rdwr(struct tcmu_device *dev, struct tcmulib_cmd *cmd)
           |      |            ^~~~~~~~~~~~~~
           |      |            |
           |      |            (6) entry to ‘zbc_check_rdwr’
           |
         ‘zbc_check_rdwr’: event 7
           |
           |cc1:
           | (7): 
           |
         ‘zbc_check_rdwr’: events 8-10
           |
           | 1885 |         struct zbc_dev *zdev = tcmur_dev_get_private(dev);
           |      |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                                |
           |      |                                (8) ...to here
           |      |                                (9) stmt: zdev_18 = tcmur_dev_get_private (dev_16(D));
           |......
           | 1891 |         if (iov_length != nr_lbas * zdev->lba_size) {
           |      |            ~                    
           |      |            |
           |      |            (10) following ‘true’ branch...
           |
         ‘zbc_check_rdwr’: event 11
           |
           |/tmp/tcmu-runner/libtcmu_log.h:51:38:
           |   51 | #define tcmu_dev_err(dev, ...)  do { tcmu_err_message(dev, __func__, __LINE__, __VA_ARGS__);} while (0)
           |      |                                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                                      |
           |      |                                      (11) ...to here
/tmp/tcmu-runner/file_zbc.c:1892:17: note: in expansion of macro ‘tcmu_dev_err’
           | 1892 |                 tcmu_dev_err(dev, "iov len mismatch: iov len %zu, xfer len %zu, block size %zu\n",
           |      |                 ^~~~~~~~~~~~
           |
         ‘zbc_check_rdwr’: event 12
           |
           |/tmp/tcmu-runner/libtcmu_log.h:51:38:
           |   51 | #define tcmu_dev_err(dev, ...)  do { tcmu_err_message(dev, __func__, __LINE__, __VA_ARGS__);} while (0)
           |      |                                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                                      |
           |      |                                      (12) stmt: _6 = zdev_18->lba_size;
/tmp/tcmu-runner/file_zbc.c:1892:17: note: in expansion of macro ‘tcmu_dev_err’
           | 1892 |                 tcmu_dev_err(dev, "iov len mismatch: iov len %zu, xfer len %zu, block size %zu\n",
           |      |                 ^~~~~~~~~~~~
           |
         ‘zbc_check_rdwr’: events 13-18
           |
           | 1894 |                 return tcmu_sense_set_data(cmd->sense_buf,
           |      |                        ~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~
           |      |                        |                      |
           |      |                        |                      (13) state of ‘&(*INIT_VAL(cmd_68(D))).sense_buf’: ‘start’ -> ‘non-heap’ (NULL origin)
           |      |                        |                      (14) stmt: _7 = &cmd_19(D)->sense_buf;
           |      |                        |                      (15) state of ‘&(*INIT_VAL(cmd_68(D))).sense_buf’: ‘start’ -> ‘non-heap’ (NULL origin)
           |      |                        |                      (16) state of ‘&(*INIT_VAL(cmd_68(D))).sense_buf’: ‘start’ -> ‘non-heap’ (NULL origin)
           |      |                        (17) stmt: _33 = tcmu_sense_set_data (_7, 4, 17408);
           |      |                        (18) 
           | 1895 |                                            HARDWARE_ERROR,
           |      |                                            ~~~~~~~~~~~~~~~
           | 1896 |                                            ASC_INTERNAL_TARGET_FAILURE);
           |      |                                            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |
         ‘zbc_check_rdwr’: event 19
           |
           |cc1:
           | (19): ...to here
           |
         ‘zbc_check_rdwr’: event 20
           |
           |cc1:
           | (20): stmt: <L5>:
           |
         ‘zbc_check_rdwr’: event 21
           |
           |cc1:
           | (21): 
           |
         ‘zbc_check_rdwr’: event 22
           |
           | 1908 | }
           |      | ^
           |      | |
           |      | (22) ...to here
           |
    <------+
    |
  ‘zbc_write’: events 23-28
    |
    | 2118 |         ret = zbc_check_rdwr(dev, cmd);
    |      |         ~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~
    |      |             | |
    |      |             | (23) returning to ‘zbc_write’ from ‘zbc_check_rdwr’
    |      |             (24) stmt: ret_78 = (ssize_t) _4;
    | 2119 |         if (ret != TCMU_STS_OK)
    |      |            ~   
    |      |            |
    |      |            (25) following ‘false’ branch (when ‘ret == 0’)...
    |......
    | 2123 |         ret = zbc_write_check_zones(dev, cmd, nr_lbas, lba);
    |      |               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |               |
    |      |               (26) ...to here
    |      |               (27) stmt: _5 = zbc_write_check_zones (dev_65(D), cmd_68(D), nr_lbas_73, lba_71);
    |      |               (28) calling ‘zbc_write_check_zones’ from ‘zbc_write’
    |
    +--> ‘zbc_write_check_zones’: event 29
           |
           | 2018 | static int zbc_write_check_zones(struct tcmu_device *dev,
           |      |            ^~~~~~~~~~~~~~~~~~~~~
           |      |            |
           |      |            (29) entry to ‘zbc_write_check_zones’
           |
         ‘zbc_write_check_zones’: event 30
           |
           |cc1:
           | (30): 
           |
         ‘zbc_write_check_zones’: events 31-39
           |
           | 2022 |         struct zbc_dev *zdev = tcmur_dev_get_private(dev);
           |      |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                                |
           |      |                                (31) ...to here
           |      |                                (32) stmt: zdev_41 = tcmur_dev_get_private (dev_39(D));
           | 2023 |         struct zbc_zone *zone;
           | 2024 |         int zone_type = 0;
           |      |             ~~~~~~~~~           
           |      |             |
           |      |             (33) 
           |......
           | 2027 |         while (nr_lbas) {
           |      |                ~~~~~~~          
           |      |                |
           |      |                (34) ...to here
           |      |                (35) stmt: if (nr_lbas_30 != 0)
           |      |                (36) following ‘true’ branch (when ‘nr_lbas != 0’)...
           |......
           | 2030 |                 zone = zbc_get_zone(zdev, lba, false);
           |      |                        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                        |
           |      |                        (37) ...to here
           |      |                        (38) stmt: zone_47 = zbc_get_zone (zdev_41, lba_31, 0);
           |      |                        (39) calling ‘zbc_get_zone’ from ‘zbc_write_check_zones’
           |
           +--> ‘zbc_get_zone’: event 40
                  |
                  | 1198 | static struct zbc_zone *zbc_get_zone(struct zbc_dev *zdev, uint64_t lba,
                  |      |                         ^~~~~~~~~~~~
                  |      |                         |
                  |      |                         (40) entry to ‘zbc_get_zone’
                  |
                ‘zbc_get_zone’: event 41
                  |
                  |cc1:
                  | (41): 
                  |
                ‘zbc_get_zone’: events 42-44
                  |
                  | 1201 |         unsigned int zno = lba / zdev->zone_size;
                  |      |                                  ~~~~^~~~~~~~~~~
                  |      |                                      |
                  |      |                                      (42) ...to here
                  |      |                                      (43) stmt: _1 = zdev_10(D)->zone_size;
                  |......
                  | 1204 |         if (zno >= zdev->nr_zones)
                  |      |            ~                          
                  |      |            |
                  |      |            (44) following ‘true’ branch...
                  |
                ‘zbc_get_zone’: event 45
                  |
                  | 1205 |                 return NULL;
                  |      |                        ^~~~
                  |      |                        |
                  |      |                        (45) ...to here
                  |
                ‘zbc_get_zone’: event 46
                  |
                  | 1205 |                 return NULL;
                  |      |                        ^~~~
                  |      |                        |
                  |      |                        (46) stmt: _17 = 0B;
                  |
                ‘zbc_get_zone’: event 47
                  |
                  | 1205 |                 return NULL;
                  |      |                        ^~~~
                  |      |                        |
                  |      |                        (47) ‘0’ is NULL
                  |
                ‘zbc_get_zone’: event 48
                  |
                  | 1205 |                 return NULL;
                  |      |                        ^~~~
                  |      |                        |
                  |      |                        (48) 
                  |
                ‘zbc_get_zone’: event 49
                  |
                  |cc1:
                  | (49): ...to here
                  |
                ‘zbc_get_zone’: event 50
                  |
                  |cc1:
                  | (50): stmt: <L6>:
                  |
                ‘zbc_get_zone’: event 51
                  |
                  |cc1:
                  | (51): 
                  |
                ‘zbc_get_zone’: event 52
                  |
                  | 1212 | }
                  |      | ^
                  |      | |
                  |      | (52) ...to here
                  |
           <------+
           |
         ‘zbc_write_check_zones’: events 53-55
           |
           | 2030 |                 zone = zbc_get_zone(zdev, lba, false);
           |      |                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                        |
           |      |                        (53) returning to ‘zbc_write_check_zones’ from ‘zbc_get_zone’
           | 2031 |                 if (!zone) {
           |      |                    ~    
           |      |                    |
           |      |                    (54) stmt: if (zone_47 == 0B)
           |      |                    (55) following ‘true’ branch (when ‘zone’ is NULL)...
           |
         ‘zbc_write_check_zones’: event 56
           |
           |/tmp/tcmu-runner/libtcmu_log.h:51:38:
           |   51 | #define tcmu_dev_err(dev, ...)  do { tcmu_err_message(dev, __func__, __LINE__, __VA_ARGS__);} while (0)
           |      |                                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                                      |
           |      |                                      (56) ...to here
/tmp/tcmu-runner/file_zbc.c:2032:25: note: in expansion of macro ‘tcmu_dev_err’
           | 2032 |                         tcmu_dev_err(zdev->dev,
           |      |                         ^~~~~~~~~~~~
           |
         ‘zbc_write_check_zones’: event 57
           |
           |/tmp/tcmu-runner/libtcmu_log.h:51:38:
           |   51 | #define tcmu_dev_err(dev, ...)  do { tcmu_err_message(dev, __func__, __LINE__, __VA_ARGS__);} while (0)
           |      |                                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                                      |
           |      |                                      (57) stmt: _1 = zdev_41->dev;
/tmp/tcmu-runner/file_zbc.c:2032:25: note: in expansion of macro ‘tcmu_dev_err’
           | 2032 |                         tcmu_dev_err(zdev->dev,
           |      |                         ^~~~~~~~~~~~
           |
         ‘zbc_write_check_zones’: events 58-63
           |
           | 2035 |                         return tcmu_sense_set_data(cmd->sense_buf,
           |      |                                ~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~
           |      |                                |                      |
           |      |                                |                      (58) state of ‘&(*INIT_VAL(cmd_68(D))).sense_buf’: ‘start’ -> ‘non-heap’ (NULL origin)
           |      |                                |                      (59) stmt: _2 = &cmd_50(D)->sense_buf;
           |      |                                |                      (60) state of ‘&(*INIT_VAL(cmd_68(D))).sense_buf’: ‘start’ -> ‘non-heap’ (NULL origin)
           |      |                                |                      (61) state of ‘&(*INIT_VAL(cmd_68(D))).sense_buf’: ‘start’ -> ‘non-heap’ (NULL origin)
           |      |                                (62) stmt: _68 = tcmu_sense_set_data (_2, 4, 17408);
           |      |                                (63) 
           | 2036 |                                                    HARDWARE_ERROR,
           |      |                                                    ~~~~~~~~~~~~~~~
           | 2037 |                                                    ASC_INTERNAL_TARGET_FAILURE);
           |      |                                                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |
         ‘zbc_write_check_zones’: event 64
           |
           |cc1:
           | (64): ...to here
           |
         ‘zbc_write_check_zones’: event 65
           |
           |cc1:
           | (65): stmt: <L22>:
           |
         ‘zbc_write_check_zones’: event 66
           |
           |cc1:
           | (66): 
           |
         ‘zbc_write_check_zones’: event 67
           |
           | 2097 | }
           |      | ^
           |      | |
           |      | (67) ...to here
           |
    <------+
    |
  ‘zbc_write’: events 68-70
    |
    | 2123 |         ret = zbc_write_check_zones(dev, cmd, nr_lbas, lba);
    |      |         ~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |             | |
    |      |             | (68) returning to ‘zbc_write’ from ‘zbc_write_check_zones’
    |      |             (69) stmt: ret_80 = (ssize_t) _5;
    | 2124 |         if (ret != TCMU_STS_OK)
    |      |            ~   
    |      |            |
    |      |            (70) following ‘false’ branch (when ‘ret == 0’)...
    |
  ‘zbc_write’: event 71
    |
    |cc1:
    | (71): ...to here
    |
  ‘zbc_write’: event 72
    |
    |cc1:
    | (72): 
    |
  ‘zbc_write’: events 73-78
    |
    | 2128 |         while (nr_lbas) {
    |      |                ^~~~~~~
    |      |                |
    |      |                (73) ...to here
    |      |                (74) stmt: if (nr_lbas_53 != 0)
    |      |                (75) following ‘true’ branch (when ‘nr_lbas != 0’)...
    |......
    | 2131 |                 zone = zbc_get_zone(zdev, lba, false);
    |      |                        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                        |
    |      |                        (76) ...to here
    |      |                        (77) stmt: zone_83 = zbc_get_zone (zdev_67, lba_52, 0);
    |      |                        (78) calling ‘zbc_get_zone’ from ‘zbc_write’
    |
    +--> ‘zbc_get_zone’: event 79
           |
           | 1198 | static struct zbc_zone *zbc_get_zone(struct zbc_dev *zdev, uint64_t lba,
           |      |                         ^~~~~~~~~~~~
           |      |                         |
           |      |                         (79) entry to ‘zbc_get_zone’
           |
         ‘zbc_get_zone’: event 80
           |
           |cc1:
           | (80): 
           |
         ‘zbc_get_zone’: events 81-83
           |
           | 1201 |         unsigned int zno = lba / zdev->zone_size;
           |      |                                  ~~~~^~~~~~~~~~~
           |      |                                      |
           |      |                                      (81) ...to here
           |      |                                      (82) stmt: _1 = zdev_10(D)->zone_size;
           |......
           | 1204 |         if (zno >= zdev->nr_zones)
           |      |            ~                          
           |      |            |
           |      |            (83) following ‘true’ branch...
           |
         ‘zbc_get_zone’: event 84
           |
           | 1205 |                 return NULL;
           |      |                        ^~~~
           |      |                        |
           |      |                        (84) ...to here
           |
         ‘zbc_get_zone’: event 85
           |
           | 1205 |                 return NULL;
           |      |                        ^~~~
           |      |                        |
           |      |                        (85) stmt: _17 = 0B;
           |
         ‘zbc_get_zone’: event 86
           |
           | 1205 |                 return NULL;
           |      |                        ^~~~
           |      |                        |
           |      |                        (86) ‘0’ is NULL
           |
         ‘zbc_get_zone’: event 87
           |
           | 1205 |                 return NULL;
           |      |                        ^~~~
           |      |                        |
           |      |                        (87) 
           |
         ‘zbc_get_zone’: event 88
           |
           |cc1:
           | (88): ...to here
           |
         ‘zbc_get_zone’: event 89
           |
           |cc1:
           | (89): stmt: <L6>:
           |
         ‘zbc_get_zone’: event 90
           |
           |cc1:
           | (90): 
           |
         ‘zbc_get_zone’: event 91
           |
           | 1212 | }
           |      | ^
           |      | |
           |      | (91) ...to here
           |
    <------+
    |
  ‘zbc_write’: event 92
    |
    | 2131 |                 zone = zbc_get_zone(zdev, lba, false);
    |      |                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                        |
    |      |                        (92) return of NULL to ‘zbc_write’ from ‘zbc_get_zone’
    |
  ‘zbc_write’: event 93
    |
    |  117 | #define zbc_zone_conv(z)        ((z)->type == ZBC_ZONE_TYPE_CONVENTIONAL)
    |      |                                  ~~~^~~~~~
    |      |                                     |
    |      |                                     (93) stmt: _6 = zone_83->type;
/tmp/tcmu-runner/file_zbc.c:120:35: note: in expansion of macro ‘zbc_zone_conv’
    |  120 | #define zbc_zone_seq(z)         (!zbc_zone_conv(z))
    |      |                                   ^~~~~~~~~~~~~
/tmp/tcmu-runner/file_zbc.c:2134:21: note: in expansion of macro ‘zbc_zone_seq’
    | 2134 |                 if (zbc_zone_seq(zone) && !zbc_zone_is_open(zone)) {
    |      |                     ^~~~~~~~~~~~
    |
  ‘zbc_write’: event 94
    |
    |  117 | #define zbc_zone_conv(z)        ((z)->type == ZBC_ZONE_TYPE_CONVENTIONAL)
    |      |                                  ~~~^~~~~~
    |      |                                     |
    |      |                                     (94) dereference of NULL ‘zone’
/tmp/tcmu-runner/file_zbc.c:120:35: note: in expansion of macro ‘zbc_zone_conv’
    |  120 | #define zbc_zone_seq(z)         (!zbc_zone_conv(z))
    |      |                                   ^~~~~~~~~~~~~
/tmp/tcmu-runner/file_zbc.c:2134:21: note: in expansion of macro ‘zbc_zone_seq’
    | 2134 |                 if (zbc_zone_seq(zone) && !zbc_zone_is_open(zone)) {
    |      |                     ^~~~~~~~~~~~
    |

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant