Showing error 1904

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: net/sunrpc/xprtrdma/rpc_rdma.c
Line in file: 226
Project: Linux Kernel
Project version: 2.6.28
Tools: Smatch (1.59)
Entered: 2013-09-11 08:47:26 UTC

Source: 

196                pos = 0;
197        else
198                pos = target->head[0].iov_len;
199
200        nsegs = rpcrdma_convert_iovs(target, pos, type, seg, RPCRDMA_MAX_SEGS);
201        if (nsegs == 0)
202                return 0;
203
204        do {
205                /* bind/register the memory, then build chunk from result. */
206                int n = rpcrdma_register_external(seg, nsegs,
207                                                cur_wchunk != NULL, r_xprt);
208                if (n <= 0)
209                        goto out;
210                if (cur_rchunk) {        /* read */
211                        cur_rchunk->rc_discrim = xdr_one;
212                        /* all read chunks have the same "position" */
213                        cur_rchunk->rc_position = htonl(pos);
214                        cur_rchunk->rc_target.rs_handle = htonl(seg->mr_rkey);
215                        cur_rchunk->rc_target.rs_length = htonl(seg->mr_len);
216                        xdr_encode_hyper(
217                                        (__be32 *)&cur_rchunk->rc_target.rs_offset,
218                                        seg->mr_base);
219                        dprintk("RPC:       %s: read chunk "
220                                "elem %d@0x%llx:0x%x pos %u (%s)\n", __func__,
221                                seg->mr_len, (unsigned long long)seg->mr_base,
222                                seg->mr_rkey, pos, n < nsegs ? "more" : "last");
223                        cur_rchunk++;
224                        r_xprt->rx_stats.read_chunk_count++;
225                } else {                /* write/reply */
226                        cur_wchunk->wc_target.rs_handle = htonl(seg->mr_rkey);
227                        cur_wchunk->wc_target.rs_length = htonl(seg->mr_len);
228                        xdr_encode_hyper(
229                                        (__be32 *)&cur_wchunk->wc_target.rs_offset,
230                                        seg->mr_base);
231                        dprintk("RPC:       %s: %s chunk "
232                                "elem %d@0x%llx:0x%x (%s)\n", __func__,
233                                (type == rpcrdma_replych) ? "reply" : "write",
234                                seg->mr_len, (unsigned long long)seg->mr_base,
235                                seg->mr_rkey, n < nsegs ? "more" : "last");
236                        cur_wchunk++;
Show full sources
↑