Fix various Disk I/O issues in all modules

* Uninitialized class members.

* Handle NULL potential after several dynamic_cast.

* Better error result handling from several system functions
  lseek(), fcntl() can report errors which need handling.

* diskd explicit NULL dereference on broken input.
  Extremely unlikely, but worth protecting against.

 Detected by Coverity Scan. Issues 740510, 740358, 740359,
  740511, 740317, 740360, 740513, 740318, 740514

diff --git a/src/DiskIO/AIO/AIODiskIOStrategy.cc b/src/DiskIO/AIO/AIODiskIOStrategy.cc
index 744e2b9b74d42d45f0a111a5c484f46149afe62e..4f2b9ab667a70a0f1e8e88a7cf2c29821896ee90 100644 (file)
--- a/src/DiskIO/AIO/AIODiskIOStrategy.cc
+++ b/src/DiskIO/AIO/AIODiskIOStrategy.cc
@@ -47,9 +47,12 @@
 #include "DiskIO/ReadRequest.h"
 #include "DiskIO/WriteRequest.h"
 
-AIODiskIOStrategy::AIODiskIOStrategy()
+AIODiskIOStrategy::AIODiskIOStrategy() :
+        fd(-1)
 {
+    aq.aq_state = AQ_STATE_NONE;
     aq.aq_numpending = 0;
+    memset(&aq.aq_queue, 0, sizeof(aq.aq_queue));
 }
 
 AIODiskIOStrategy::~AIODiskIOStrategy()

diff --git a/src/DiskIO/DiskDaemon/DiskdFile.cc b/src/DiskIO/DiskDaemon/DiskdFile.cc
index 9ab2b7b3c14bdb2edb0d623d7a79f34f6fc7e3b8..1a992482027fb99ff59d1b78dd37f3681c698429 100644 (file)
--- a/src/DiskIO/DiskDaemon/DiskdFile.cc
+++ b/src/DiskIO/DiskDaemon/DiskdFile.cc
@@ -72,8 +72,11 @@ DiskdFile::operator delete(void *address)
     cbdataFree(t);
 }
 
-DiskdFile::DiskdFile(char const *aPath, DiskdIOStrategy *anIO) : errorOccured (false), IO(anIO),
-        inProgressIOs (0)
+DiskdFile::DiskdFile(char const *aPath, DiskdIOStrategy *anIO) :
+        errorOccured(false),
+        IO(anIO),
+        mode(0),
+        inProgressIOs(0)
 {
     assert (aPath);
     debugs(79, 3, "DiskdFile::DiskdFile: " << aPath);
@@ -385,8 +388,10 @@ DiskdFile::readDone(diomsg * M)
     debugs(79, 3, "DiskdFile::readDone: status " << M->status);
     assert (M->requestor);
     ReadRequest::Pointer readRequest = dynamic_cast<ReadRequest *>(M->requestor);
+
     /* remove the free protection */
-    readRequest->unlock();
+    if (readRequest != NULL)
+        readRequest->unlock();
 
     if (M->status < 0) {
         ++diskd_stats.read.fail;
@@ -410,7 +415,8 @@ DiskdFile::writeDone(diomsg *M)
     assert (M->requestor);
     WriteRequest::Pointer writeRequest = dynamic_cast<WriteRequest *>(M->requestor);
     /* remove the free protection */
-    writeRequest->unlock();
+    if (writeRequest != NULL)
+        writeRequest->unlock();
 
     if (M->status < 0) {
         errorOccured = true;

diff --git a/src/DiskIO/DiskDaemon/diskd.cc b/src/DiskIO/DiskDaemon/diskd.cc
index 7daf23cb895c47f02ed9220b5212409d3a44370d..3ded10eeae2df8f862d1cd227c793b3706295939 100644 (file)
--- a/src/DiskIO/DiskDaemon/diskd.cc
+++ b/src/DiskIO/DiskDaemon/diskd.cc
@@ -270,6 +270,10 @@ msg_handle(diomsg * r, int rl, diomsg * s)
 
     if (s->shm_offset > -1)
         buf = shmbuf + s->shm_offset;
+    else {
+        printf(stderr, "%d UNLNK id(%u) Error: no filename in shm buffer\n", (int) mypid, s->id);
+        return EINVAL;
+    }
 
     switch (r->mtype) {
 
@@ -374,7 +378,10 @@ main(int argc, char *argv[])
 
     hash = hash_create(fsCmp, 1 << 4, fsHash);
     assert(hash);
-    fcntl(0, F_SETFL, SQUID_NONBLOCK);
+    if (fcntl(0, F_SETFL, SQUID_NONBLOCK) < 0) {
+        perror(xstrerror());
+        return 1;
+    }
     memset(&sa, '\0', sizeof(sa));
     sa.sa_handler = alarm_handler;
     sa.sa_flags = SA_RESTART;

diff --git a/src/DiskIO/DiskThreads/DiskThreadsIOStrategy.cc b/src/DiskIO/DiskThreads/DiskThreadsIOStrategy.cc
index 8d0da2a9d403dc2ce06aa811b1df62ddc646dc48..0aa9a01ba665195833eeaba2eaf240a12a0f80de 100644 (file)
--- a/src/DiskIO/DiskThreads/DiskThreadsIOStrategy.cc
+++ b/src/DiskIO/DiskThreads/DiskThreadsIOStrategy.cc
@@ -187,7 +187,10 @@ DiskThreadsIOStrategy::sync()
     debugs(32, 2, "aioSync: done");
 }
 
-DiskThreadsIOStrategy::DiskThreadsIOStrategy() :  initialised (false) {}
+DiskThreadsIOStrategy::DiskThreadsIOStrategy() :
+        initialised(false),
+        squidaio_ctrl_pool(NULL)
+{}
 
 void
 DiskThreadsIOStrategy::aioStats(StoreEntry * sentry)

diff --git a/src/DiskIO/DiskThreads/aiops.cc b/src/DiskIO/DiskThreads/aiops.cc
index 1269c27d0bb77676fb53a837bbe9407e542f8b56..725c9f461aa6fd78699ccc9385b9c95640c35c27 100644 (file)
--- a/src/DiskIO/DiskThreads/aiops.cc
+++ b/src/DiskIO/DiskThreads/aiops.cc
@@ -722,8 +722,10 @@ squidaio_read(int fd, char *bufp, size_t bufs, off_t offset, int whence, squidai
 static void
 squidaio_do_read(squidaio_request_t * requestp)
 {
-    lseek(requestp->fd, requestp->offset, requestp->whence);
-    requestp->ret = read(requestp->fd, requestp->bufferp, requestp->buflen);
+    if (lseek(requestp->fd, requestp->offset, requestp->whence) >= 0)
+        requestp->ret = read(requestp->fd, requestp->bufferp, requestp->buflen);
+    else
+        requestp->ret = -1;
     requestp->err = errno;
 }
 

diff --git a/src/DiskIO/IpcIo/IpcIoFile.cc b/src/DiskIO/IpcIo/IpcIoFile.cc
index 83d8f13f86cfb4c8223a94d792986dbd6acc626b..dba711984eec1b5da5076a4eab8670fcb0f04034 100644 (file)
--- a/src/DiskIO/IpcIo/IpcIoFile.cc
+++ b/src/DiskIO/IpcIo/IpcIoFile.cc
@@ -588,9 +588,14 @@ IpcIoFile::getFD() const
 /* IpcIoMsg */
 
 IpcIoMsg::IpcIoMsg():
-        requestId(0), offset(0), len(0), command(IpcIo::cmdNone), xerrno(0)
+        requestId(0),
+        offset(0),
+        len(0),
+        command(IpcIo::cmdNone),
+        xerrno(0)
 {
     start.tv_sec = 0;
+    start.tv_usec = 0;
 }
 
 /* IpcIoPendingRequest */