Showing error 1661

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: fs/xfs/quota/xfs_qm.c
Line in file: 1582
Project: Linux Kernel
Project version: 2.6.28
Tools: Smatch (1.59)
Entered: 2013-09-10 07:54:05 UTC

Source: 

1552         * This looks racy, but we can't keep an inode lock across a
1553         * trans_reserve. But, this gets called during quotacheck, and that
1554         * happens only at mount time which is single threaded.
1555         */
1556        if (qip->i_d.di_nblocks == 0)
1557                return 0;
1558
1559        map = kmem_alloc(XFS_DQITER_MAP_SIZE * sizeof(*map), KM_SLEEP);
1560
1561        lblkno = 0;
1562        maxlblkcnt = XFS_B_TO_FSB(mp, (xfs_ufsize_t)XFS_MAXIOFFSET(mp));
1563        do {
1564                nmaps = XFS_DQITER_MAP_SIZE;
1565                /*
1566                 * We aren't changing the inode itself. Just changing
1567                 * some of its data. No new blocks are added here, and
1568                 * the inode is never added to the transaction.
1569                 */
1570                xfs_ilock(qip, XFS_ILOCK_SHARED);
1571                error = xfs_bmapi(NULL, qip, lblkno,
1572                                  maxlblkcnt - lblkno,
1573                                  XFS_BMAPI_METADATA,
1574                                  NULL,
1575                                  0, map, &nmaps, NULL, NULL);
1576                xfs_iunlock(qip, XFS_ILOCK_SHARED);
1577                if (error)
1578                        break;
1579
1580                ASSERT(nmaps <= XFS_DQITER_MAP_SIZE);
1581                for (i = 0; i < nmaps; i++) {
1582                        ASSERT(map[i].br_startblock != DELAYSTARTBLOCK);
1583                        ASSERT(map[i].br_blockcount);
1584
1585
1586                        lblkno += map[i].br_blockcount;
1587
1588                        if (map[i].br_startblock == HOLESTARTBLOCK)
1589                                continue;
1590
1591                        firstid = (xfs_dqid_t) map[i].br_startoff *
1592                                XFS_QM_DQPERBLK(mp);
Show full sources
↑