Subject: RE: Coverity: irdma_fill_device_info(): Null pointer dereferences

From: "Saleem, Shiraz" <[email-masked]>
Date: Thu, 17 Jun 2021 14:18:19 +0000

> Subject: Re: Coverity: irdma_fill_device_info(): Null pointer dereferences
> 
> On Tue, Jun 15, 2021 at 03:58:52PM +0000, Saleem, Shiraz wrote:
> > > Subject: Coverity: irdma_fill_device_info(): Null pointer
> > > dereferences
> > >
> > > Hello!
> > >
> > > This is an experimental semi-automated report about issues detected
> > > by Coverity from a scan of next-20210608 as part of the linux-next scan
> project:
> > > https://scan.coverity.com/projects/linux-next-weekly-scan
> > >
> > > You're getting this email because you were associated with the
> > > identified lines of code (noted below) that were touched by commits:
> > >
> > >   Wed Jun 2 19:55:16 2021 -0300
> > >     8498a30e1b94 ("RDMA/irdma: Register auxiliary driver and
> > > implement private channel OPs")
> > >
> > > Coverity reported the following:
> > >
> > > *** CID 1505164:  Null pointer dereferences  (NULL_RETURNS)
> > > /drivers/infiniband/hw/irdma/main.c: 230 in irdma_fill_device_info()
> > > 224     	rf->gen_ops.register_qset = irdma_lan_register_qset;
> > > 225     	rf->gen_ops.unregister_qset = irdma_lan_unregister_qset;
> > > 226     	rf->hw.hw_addr = pf->hw.hw_addr;
> > > 227     	rf->pcidev = pf->pdev;
> > > 228     	rf->msix_count =  pf->num_rdma_msix;
> > > 229     	rf->msix_entries = &pf->msix_entries[pf->rdma_base_vector];
> > > vvv     CID 1505164:  Null pointer dereferences  (NULL_RETURNS)
> > > vvv     Dereferencing "vsi", which is known to be "NULL".
> >
> > This is a false +ve IMO.
> 
> It is because of this:
> 
> static inline struct ice_vsi *ice_get_main_vsi(struct ice_pf *pf) {
>         if (pf->vsi)
>                 return pf->vsi[0];
> 
>         return NULL;
> }
> 
> If the above can't return null it should be rewritten

It does appear on review that the pf->vsi can really never be NULL for paths that call ice_get_main_vsi.
We are running some tests to confirm there is no fallout. And if so, we can just return pf->vsi[0]
as a fix.

Shiraz