Fix bugs found in MFS by clang static analyzer.

diff --git a/servers/mfs/link.c b/servers/mfs/link.c
index 580988e2cddba5e427dc3a351efef0f89177b291..07ae0a81ddf55a887ef1ece50b0ec7bfccb68765 100644 (file)
--- a/servers/mfs/link.c
+++ b/servers/mfs/link.c
@@ -321,12 +321,16 @@ PUBLIC int fs_rename()
        old_ip = NULL;
        if (r == EENTERMOUNT) r = EXDEV;        /* should this fail at all? */
        else if (r == ELEAVEMOUNT) r = EINVAL;  /* rename on dot-dot */
+  } else if (old_ip == NULL) {
+       return(err_code);
   }
 
   /* Get new dir inode */ 
-  if( (new_dirp = get_inode(fs_dev, (ino_t) fs_m_in.REQ_REN_NEW_DIR)) == NULL) 
-       r = err_code;
-  else {
+  if( (new_dirp = get_inode(fs_dev, (ino_t) fs_m_in.REQ_REN_NEW_DIR)) == NULL) {
+        put_inode(old_ip);
+        put_inode(old_dirp);
+        return(err_code);
+  } else {
        if (new_dirp->i_nlinks == NO_LINK) {    /* Dir does not actually exist */
                put_inode(old_ip);
                put_inode(old_dirp);

diff --git a/servers/mfs/main.c b/servers/mfs/main.c
index c5eaa1450b88ea58af5fa5a2d2927299ca1d3915..76d7198eaf010f88f1d3e21572b5ad553258f2e7 100644 (file)
--- a/servers/mfs/main.c
+++ b/servers/mfs/main.c
@@ -30,7 +30,7 @@ PUBLIC int main(int argc, char *argv[])
  * three major activities: getting new work, processing the work, and
  * sending the reply. The loop never terminates, unless a panic occurs.
  */
-  int error, ind, transid;
+  int error = OK, ind, transid;
 
   /* SEF local startup. */
   env_setargs(argc, argv);
@@ -52,7 +52,6 @@ PUBLIC int main(int argc, char *argv[])
                assert(IS_VFS_FS_TRANSID(transid));
 
        src = fs_m_in.m_source;
-       error = OK;
        caller_uid = INVAL_UID; /* To trap errors */
        caller_gid = INVAL_GID;
        req_nr = fs_m_in.m_type;

diff --git a/servers/mfs/read.c b/servers/mfs/read.c
index 56b129c1e455276ea1f8ebcfc72f52fd0d4095ea..b4eda32826634d6f264a34e25fff4338c9379f78 100644 (file)
--- a/servers/mfs/read.c
+++ b/servers/mfs/read.c
@@ -466,6 +466,7 @@ unsigned bytes_ahead;               /* bytes beyond position for immediate use */
 
   block = baseblock;
   bp = get_block(dev, block, PREFETCH);
+  assert(bp != NULL);
   if (bp->b_dev != NO_DEV) return(bp);
 
   /* The best guess for the number of blocks to prefetch:  A lot.

diff --git a/servers/mfs/stats.c b/servers/mfs/stats.c
index 6fcd933b02db64901670cfb9d07803ed915815ea..663581db53a769f37deac1d3d249ea59267e5095 100644 (file)
--- a/servers/mfs/stats.c
+++ b/servers/mfs/stats.c
@@ -27,6 +27,8 @@ int map;                      /* IMAP (inode map) or ZMAP (zone map) */
   bit_t i, b;
   bit_t free_bits;
 
+  assert(sp != NULL);
+
   if (map == IMAP) {
     start_block = START_BLOCK;
     map_bits = (bit_t) (sp->s_ninodes + 1);

diff --git a/servers/mfs/write.c b/servers/mfs/write.c
index 8b1df10ca6c3e3463ac267644415a6f598b1093f..4acbf45a1cadae514388de69e322f7b9d635fd95 100644 (file)
--- a/servers/mfs/write.c
+++ b/servers/mfs/write.c
@@ -92,7 +92,7 @@ int op;                               /* special actions */
        excess = excess % nr_indirects;
        if (ind_ex >= nr_indirects) return(EFBIG);
 
-       if(z == NO_ZONE) {
+       if(z == NO_ZONE && (op & WMAP_FREE)) {
                /* WMAP_FREE and no double indirect block - then no
                 * single indirect block either.
                 */