xfs_repair: fix some potential null pointer deferences

Fix some potential NULL pointer deferences that Coverity pointed out,
and remove a trivial dead integer check.

Coverity-id: 1375789, 1375790, 1375791, 1375792
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>

diff --git a/repair/phase5.c b/repair/phase5.c
index 3604d1d9c8519d110114c95f4e48b5c8da4a0902..cbda556427df70ba79a6dc3165016cda93957207 100644 (file)
--- a/repair/phase5.c
+++ b/repair/phase5.c
@@ -1925,7 +1925,7 @@ _("Insufficient memory to construct refcount cursor."));
        refc_rec = pop_slab_cursor(refc_cur);
        lptr = &btree_curs->level[0];
 
-       for (i = 0; i < lptr->num_blocks; i++)  {
+       for (i = 0; i < lptr->num_blocks && refc_rec != NULL; i++)  {
                /*
                 * block initialization, lay in block header
                 */

diff --git a/repair/rmap.c b/repair/rmap.c
index 45e183ac4864c7296f9435c2870079eae98316a4..7508973c581c49729a86a30d5519142fc252daf6 100644 (file)
--- a/repair/rmap.c
+++ b/repair/rmap.c
@@ -790,7 +790,7 @@ compute_refcounts(
                mark_inode_rl(mp, stack_top);
 
                /* Set nbno to the bno of the next refcount change */
-               if (n < slab_count(rmaps))
+               if (n < slab_count(rmaps) && array_cur)
                        nbno = array_cur->rm_startblock;
                else
                        nbno = NULLAGBLOCK;

diff --git a/repair/slab.h b/repair/slab.h
index 4aa551212581e2902a91451c9f13d10445566d41..a2201f14a981f2413c477f59abe6789f638bef5a 100644 (file)
--- a/repair/slab.h
+++ b/repair/slab.h
@@ -54,7 +54,7 @@ extern void *bag_item(struct xfs_bag *, size_t);
 
 #define foreach_bag_ptr_reverse(bag, idx, ptr) \
        for ((idx) = bag_count(bag) - 1, (ptr) = bag_item((bag), (idx)); \
-            (idx) >= 0 && (ptr) != NULL; \
+            (ptr) != NULL; \
             (idx)--, (ptr) = bag_item((bag), (idx)))
 
 #endif /* SLAB_H_ */