From owner-svn-src-head@FreeBSD.ORG Mon Nov 17 23:04:20 2008 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 403F71065674; Mon, 17 Nov 2008 23:04:20 +0000 (UTC) (envelope-from jhb@freebsd.org) Received: from server.baldwin.cx (bigknife-pt.tunnel.tserv9.chi1.ipv6.he.net [IPv6:2001:470:1f10:75::2]) by mx1.freebsd.org (Postfix) with ESMTP id A905D8FC19; Mon, 17 Nov 2008 23:04:19 +0000 (UTC) (envelope-from jhb@freebsd.org) Received: from localhost.corp.yahoo.com (john@localhost [IPv6:::1]) (authenticated bits=0) by server.baldwin.cx (8.14.3/8.14.3) with ESMTP id mAHN4Ddg034550; Mon, 17 Nov 2008 18:04:13 -0500 (EST) (envelope-from jhb@freebsd.org) From: John Baldwin To: Pawel Jakub Dawidek Date: Mon, 17 Nov 2008 16:32:19 -0500 User-Agent: KMail/1.9.7 References: <200811170709.mAH79ecr075977@svn.freebsd.org> <20081117165006.GA1489@garage.freebsd.pl> In-Reply-To: <20081117165006.GA1489@garage.freebsd.pl> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200811171632.19955.jhb@freebsd.org> X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-2.0.2 (server.baldwin.cx [IPv6:::1]); Mon, 17 Nov 2008 18:04:13 -0500 (EST) X-Virus-Scanned: ClamAV 0.93.1/8643/Mon Nov 17 14:40:22 2008 on server.baldwin.cx X-Virus-Status: Clean X-Spam-Status: No, score=-2.6 required=4.2 tests=AWL,BAYES_00,NO_RELAYS autolearn=ham version=3.1.3 X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) on server.baldwin.cx Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org, Philip Paeps Subject: Re: svn commit: r185021 - head/sys/dev/glxsb X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Nov 2008 23:04:20 -0000 On Monday 17 November 2008 11:51:52 am Pawel Jakub Dawidek wrote: > On Mon, Nov 17, 2008 at 07:09:40AM +0000, Philip Paeps wrote: > > Author: philip > > Date: Mon Nov 17 07:09:40 2008 > > New Revision: 185021 > > URL: http://svn.freebsd.org/changeset/base/185021 > > > > Log: > > Fix two possible (but unlikely) NULL-pointer dereferences in glxsb(4). > > > > Spotted by: Coverity > > MFC after: 1 week > > > > Modified: > > head/sys/dev/glxsb/glxsb.c > > > > Modified: head/sys/dev/glxsb/glxsb.c > > ============================================================================== > > --- head/sys/dev/glxsb/glxsb.c Mon Nov 17 07:03:05 2008 (r185020) > > +++ head/sys/dev/glxsb/glxsb.c Mon Nov 17 07:09:40 2008 (r185021) > > @@ -358,7 +358,8 @@ glxsb_detach(device_t dev) > > return (EBUSY); > > } > > } > > - while ((ses = TAILQ_FIRST(&sc->sc_sessions)) != NULL) { > > + while (!TAILQ_EMPTY(&sc->sc_sessions)) { > > + ses = TAILQ_FIRST(&sc->sc_sessions); > > This is perfectly valid, and if it was reported by coverity, it is a > false positive. Yes, I've flagged several false positives of this type in Coverity previously. It doesn't like that construct as it doesn't realize that TAILQ_REMOVE is changing the head (hard for it to go through the *tqe_prev indirection I think). -- John Baldwin