(This is from the Coverity scanner, CID 1396)
In iser_initiator.c there is suspicious code in iser_rcv_completion().
We start with
char *rx_data = NULL;
int rx_data_len = 0;
and then do
if (dto_xfer_len > ISER_TOTAL_HEADERS_LEN) { /* we have data */
rx_data_len = dto_xfer_len - ISER_TOTAL_HEADERS_LEN;
rx_data = dto->regd[1]->virt_addr;
rx_data += dto->offset[1];
}
I see no assignment to rx_data if dto_xfer_len <= ISER_TOTAL_HEADERS_LEN.
Then after a bunch of other stuff, we do
iscsi_iser_recv(conn->iscsi_conn, hdr, rx_data, rx_data_len);
Coverity eventually follows this path to iscsi_scsi_cmd_rsp(), which
might dereference rx_data directly.
Is this a "can't happen" false positive or is there really a problem here?
- R.
_______________________________________________
openib-general mailing list
[email protected]
http://openib.org/mailman/listinfo/openib-general
To unsubscribe, please visit http://openib.org/mailman/listinfo/openib-general
