Showing error 1754

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: fs/hfsplus/brec.c
Line in file: 307
Project: Linux Kernel
Project version: 2.6.28
Tools: Smatch (1.59)
Entered: 2013-09-10 20:24:52 UTC

Source: 

277        while (num_recs) {
278                hfs_bnode_write_u16(new_node, new_rec_off, new_off);
279                old_rec_off -= 2;
280                new_rec_off -= 2;
281                data_end = hfs_bnode_read_u16(node, old_rec_off);
282                new_off = data_end - size;
283                num_recs--;
284        }
285        hfs_bnode_write_u16(new_node, new_rec_off, new_off);
286        hfs_bnode_copy(new_node, 14, node, data_start, data_end - data_start);
287
288        /* update new bnode header */
289        node_desc.next = cpu_to_be32(new_node->next);
290        node_desc.prev = cpu_to_be32(new_node->prev);
291        node_desc.type = new_node->type;
292        node_desc.height = new_node->height;
293        node_desc.num_recs = cpu_to_be16(new_node->num_recs);
294        node_desc.reserved = 0;
295        hfs_bnode_write(new_node, &node_desc, 0, sizeof(node_desc));
296
297        /* update previous bnode header */
298        node->next = new_node->this;
299        hfs_bnode_read(node, &node_desc, 0, sizeof(node_desc));
300        node_desc.next = cpu_to_be32(node->next);
301        node_desc.num_recs = cpu_to_be16(node->num_recs);
302        hfs_bnode_write(node, &node_desc, 0, sizeof(node_desc));
303
304        /* update next bnode header */
305        if (new_node->next) {
306                struct hfs_bnode *next_node = hfs_bnode_find(tree, new_node->next);
307                next_node->prev = new_node->this;
308                hfs_bnode_read(next_node, &node_desc, 0, sizeof(node_desc));
309                node_desc.prev = cpu_to_be32(next_node->prev);
310                hfs_bnode_write(next_node, &node_desc, 0, sizeof(node_desc));
311                hfs_bnode_put(next_node);
312        } else if (node->this == tree->leaf_tail) {
313                /* if there is no next node, this might be the new tail */
314                tree->leaf_tail = new_node->this;
315                mark_inode_dirty(tree->inode);
316        }
317
Show full sources
↑