diff mbox series

[ovs-dev,3/8] jsonrpc: Don't access ovs_list members directly

Message ID 20240820131444.1724438-4-mkp@redhat.com
State Superseded, archived
Headers show
Series Address clang analyze warnings. | expand

Checks

Context Check Description
ovsrobot/apply-robot warning apply and check: warning
ovsrobot/github-robot-_Build_and_Test success github build: passed

Commit Message

Mike Pattrick Aug. 20, 2024, 1:14 p.m. UTC
The Clang analyzer has trouble tracking the pointer usage in jsonrpc_run
and will report a use after free incorrectly. This patch migrates to
using standard ovs_list functions instead of directly accessing the next
member, which supresses clang's warning.

Signed-off-by: Mike Pattrick <mkp@redhat.com>
---
 lib/jsonrpc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Comments

Simon Horman Aug. 28, 2024, 10:58 a.m. UTC | #1
On Tue, Aug 20, 2024 at 09:14:39AM -0400, Mike Pattrick wrote:
> The Clang analyzer has trouble tracking the pointer usage in jsonrpc_run
> and will report a use after free incorrectly. This patch migrates to
> using standard ovs_list functions instead of directly accessing the next
> member, which supresses clang's warning.
> 
> Signed-off-by: Mike Pattrick <mkp@redhat.com>

Acked-by: Simon Horman <horms@ovn.org>

I just realised I'm reviewing v1 instead of v2.
Sorry about that.
diff mbox series

Patch

diff --git a/lib/jsonrpc.c b/lib/jsonrpc.c
index f1ef70950..2e35180f8 100644
--- a/lib/jsonrpc.c
+++ b/lib/jsonrpc.c
@@ -120,7 +120,8 @@  jsonrpc_run(struct jsonrpc *rpc)
 
     stream_run(rpc->stream);
     while (!ovs_list_is_empty(&rpc->output)) {
-        struct ofpbuf *buf = ofpbuf_from_list(rpc->output.next);
+        struct ovs_list *head = ovs_list_front(&rpc->output);
+        struct ofpbuf *buf = ofpbuf_from_list(head);
         int retval;
 
         retval = stream_send(rpc->stream, buf->data, buf->size);
@@ -128,7 +129,7 @@  jsonrpc_run(struct jsonrpc *rpc)
             rpc->backlog -= retval;
             ofpbuf_pull(buf, retval);
             if (!buf->size) {
-                ovs_list_remove(&buf->list_node);
+                ovs_list_remove(head);
                 rpc->output_count--;
                 ofpbuf_delete(buf);
             }