In setup_namespace(), pfn|dax|btt is obtained by calling ndctl_region_get_**_seed(), which may return NULL. So we need to check whether pfn|dax|btt is NULL before accessing them. Signed-off-by: Zhiqiang Liu <liuzhiqiang26(a)huawei.com&gt; --- ndctl/namespace.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/ndctl/namespace.c b/ndctl/namespace.c index e946bb6..257384d 100644 --- a/ndctl/namespace.c +++ b/ndctl/namespace.c @@ -549,6 +549,8 @@ static int setup_namespace(struct ndctl_region *region, if (do_setup_pfn(ndns, p)) { struct ndctl_pfn *pfn = ndctl_region_get_pfn_seed(region); + if (!pfn) + return -ENXIO; rc = check_dax_align(ndns); if (rc) @@ -563,6 +565,8 @@ static int setup_namespace(struct ndctl_region *region, ndctl_pfn_set_namespace(pfn, NULL); } else if (p->mode == NDCTL_NS_MODE_DEVDAX) { struct ndctl_dax *dax = ndctl_region_get_dax_seed(region); + if (!dax) + return -ENXIO; rc = check_dax_align(ndns); if (rc) @@ -577,7 +581,8 @@ static int setup_namespace(struct ndctl_region *region, ndctl_dax_set_namespace(dax, NULL); } else if (p->mode == NDCTL_NS_MODE_SECTOR) { struct ndctl_btt *btt = ndctl_region_get_btt_seed(region); - + if (!btt) + return -ENXIO; /* * Handle the case of btt on a pmem namespace where the * pmem kernel support is pre-v1.2 namespace labels -- 1.8.3.1

In add_bus(), bus->bus_path is set by calling parent_dev_path(), which will finally adopt realpath(, NULL) to allocate new path. However, bus->bus_path will not be freed in err_read tag, then, memory leakage occurs. Signed-off-by: Zhiqiang Liu <liuzhiqiang26(a)huawei.com&gt; --- ndctl/lib/libndctl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/ndctl/lib/libndctl.c b/ndctl/lib/libndctl.c index ad521d3..3926382 100644 --- a/ndctl/lib/libndctl.c +++ b/ndctl/lib/libndctl.c @@ -975,6 +975,7 @@ static void *add_bus(void *parent, int id, const char *ctl_base) free(bus->wait_probe_path); free(bus->scrub_path); free(bus->provider); + free(bus->bus_path); free(bus->bus_buf); free(bus); err_bus: -- 1.8.3.1

In add_dax_region(), region->devname is allocated by calling strdup(), which may return NULL. So, we need to check whether region->devname is NULL, and free region->devname in err_read tag. Signed-off-by: Zhiqiang Liu <liuzhiqiang26(a)huawei.com&gt; --- daxctl/lib/libdaxctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/daxctl/lib/libdaxctl.c b/daxctl/lib/libdaxctl.c index ee4a069..d841b78 100644 --- a/daxctl/lib/libdaxctl.c +++ b/daxctl/lib/libdaxctl.c @@ -287,6 +287,8 @@ static struct daxctl_region *add_dax_region(void *parent, int id, region->refcount = 1; list_head_init(&region->devices); region->devname = strdup(devpath_to_devname(base)); + if (!region->devname) + goto err_read; sprintf(path, "%s/%s/size", base, attrs); if (sysfs_read_attr(ctx, path, buf) == 0) @@ -314,6 +316,7 @@ static struct daxctl_region *add_dax_region(void *parent, int id, err_read: free(region->region_buf); free(region->region_path); + free(region->devname); free(region); err_region: free(path); -- 1.8.3.1

In dimm_action(), actx.f_out and actx.f_in may be set by calling fopen(). If exceptions occur, we will directly goto out tag. However, we did not close actx.f_out|actx.f_in in out tag, which will cause fd leakage. Signed-off-by: Zhiqiang Liu <liuzhiqiang26(a)huawei.com&gt; --- ndctl/dimm.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/ndctl/dimm.c b/ndctl/dimm.c index 90eb0b8..2f52cda 100644 --- a/ndctl/dimm.c +++ b/ndctl/dimm.c @@ -1352,7 +1352,7 @@ static int dimm_action(int argc, const char **argv, struct ndctl_ctx *ctx, fprintf(stderr, "failed to open: %s: (%s)\n", param.infile, strerror(errno)); rc = -errno; - goto out; + goto out_close_fout; } } @@ -1371,7 +1371,7 @@ static int dimm_action(int argc, const char **argv, struct ndctl_ctx *ctx, fprintf(stderr, "'%s' is not a valid label version\n", param.labelversion); rc = -EINVAL; - goto out; + goto out_close_fin_fout; } rc = 0; @@ -1423,12 +1423,14 @@ static int dimm_action(int argc, const char **argv, struct ndctl_ctx *ctx, util_display_json_array(actx.f_out, actx.jdimms, flags); } - if (actx.f_out != stdout) - fclose(actx.f_out); - + out_close_fin_fout: if (actx.f_in != stdin) fclose(actx.f_in); + out_close_fout: + if (actx.f_out != stdout) + fclose(actx.f_out); + out: /* * count if some actions succeeded, 0 if none were attempted, -- 1.8.3.1

In exec_man_konqueror(), new is allocated by calling strdup(), which may return NULL. We should check whether new is NULL before using it. Signed-off-by: Zhiqiang Liu <liuzhiqiang26(a)huawei.com&gt; --- util/help.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/util/help.c b/util/help.c index 2d57fa1..f867944 100644 --- a/util/help.c +++ b/util/help.c @@ -44,8 +44,14 @@ static void exec_man_konqueror(const char *path, const char *page) if (path) { const char *file = strrchr(path, '/'); if (file && !strcmp(file + 1, "konqueror")) { + char *dest; char *new = strdup(path); - char *dest = strrchr(new, '/'); + if (!new) { + pr_err("strdup(path) fails.\n"); + exit(1); + } + + dest = strrchr(new, '/'); /* strlen("konqueror") == strlen("kfmclient") */ strcpy(dest + 1, "kfmclient"); -- 1.8.3.1

On Fri, 2020-11-06 at 17:27 +0800, Zhiqiang Liu wrote: This looks good in general, but I made some small fixups while applying. Printing the bus provider here isn't as useful - I replaced it with printing the namespace 'devname': - err(ctx, "bus: %s failed to create cmd\n", ndctl_bus_get_provider(bus)); + err(ctx, "%s: failed to create cmd\n", + ndctl_namespace_get_devname(ndns)); Also fixed up a couple of typos in commit messages, but otherwise the series looks good and I've applied it for v71. Thanks, -Vishal

ndctl_btt_get_namespace() may return NULL, so we need to check return value of ndctl_btt_get_namespace() before using the return value in callers. Signed-off-by: Zhiqiang Liu <liuzhiqiang26(a)huawei.com&gt; --- test/libndctl.c | 16 +++++++++++----- test/parent-uuid.c | 2 +- util/json.c | 3 +++ 3 files changed, 15 insertions(+), 6 deletions(-) diff --git a/test/libndctl.c b/test/libndctl.c index 994e0fa..a8db388 100644 --- a/test/libndctl.c +++ b/test/libndctl.c @@ -983,13 +983,19 @@ static int check_pfn_create(struct ndctl_region *region, static int check_btt_size(struct ndctl_btt *btt) { + unsigned long long ns_size; + unsigned long sect_size; + unsigned long long actual, expect; + int size_select, sect_select; struct ndctl_ctx *ctx = ndctl_btt_get_ctx(btt); struct ndctl_test *test = ndctl_get_private_data(ctx); struct ndctl_namespace *ndns = ndctl_btt_get_namespace(btt); - unsigned long long ns_size = ndctl_namespace_get_size(ndns); - unsigned long sect_size = ndctl_btt_get_sector_size(btt); - unsigned long long actual, expect; - int size_select, sect_select; + + if (!ndns) + return -ENXIO; + + ns_size = ndctl_namespace_get_size(ndns); + sect_size = ndctl_btt_get_sector_size(btt); unsigned long long expect_table[][2] = { [0] = { [0] = 0x11b5400, @@ -1461,7 +1467,7 @@ static int check_btt_autodetect(struct ndctl_bus *bus, if (!ndctl_btt_is_enabled(btt)) continue; btt_ndns = ndctl_btt_get_namespace(btt); - if (strcmp(ndctl_namespace_get_devname(btt_ndns), devname) != 0) + if (!btt_ndns || strcmp(ndctl_namespace_get_devname(btt_ndns), devname) != 0) continue; fprintf(stderr, "%s: btt_ndns: %p ndns: %p\n", __func__, btt_ndns, ndns); diff --git a/test/parent-uuid.c b/test/parent-uuid.c index f41ca2c..303b30b 100644 --- a/test/parent-uuid.c +++ b/test/parent-uuid.c @@ -115,7 +115,7 @@ static struct ndctl_btt *check_valid_btt(struct ndctl_region *region, if (!ndctl_btt_is_enabled(btt)) continue; btt_ndns = ndctl_btt_get_namespace(btt); - if (strcmp(ndctl_namespace_get_devname(btt_ndns), + if (!btt_ndns || strcmp(ndctl_namespace_get_devname(btt_ndns), ndctl_namespace_get_devname(ndns)) != 0) continue; return btt; diff --git a/util/json.c b/util/json.c index 77bd478..1392403 100644 --- a/util/json.c +++ b/util/json.c @@ -1004,6 +1004,9 @@ static void util_btt_badblocks_to_json(struct ndctl_btt *btt, struct ndctl_namespace *ndns = ndctl_btt_get_namespace(btt); unsigned long long begin, size; + if (!ndns) + return; + begin = ndctl_namespace_get_resource(ndns); if (begin == ULLONG_MAX) return; -- 1.8.3.1