From: Jeff King <peff@peff.net>
Date: Wed, 03 Sep 2025 11:18:29 GMT
Subject: Re: [PATCH v3] alloc: fix dangling pointer in alloc_state cleanup
Message-ID: <20250903111829.GA1877518@coredump.intra.peff.net>
In-Reply-To: <pull.2040.v3.git.git.1756472406487.gitgitgadget@gmail.com>

On Fri, Aug 29, 2025 at 01:00:06PM +0000, ノウラ | Flare via GitGitGadget wrote:

> +void alloc_state_free_and_null(struct alloc_state **s_)
>  {
> +	struct alloc_state *s = *s_;
> +
> +	if (!s_ || !*s_) return;
> +

Coverity complains that there's a NULL check here for "s_", but we'll
have already dereferenced it in the initializer for "s".

I don't think any caller passes NULL, so you can't trigger a segfault in
practice. But the code is kind of misleading. Should it just be:

  if (!*s_)
	return;

? Or even just "if (!s)".

-Peff