* [Qemu-devel] [PULL 0/1] Block patches 2018-03-01
@ 2018-03-01 7:54 Fam Zheng
2018-03-01 7:54 ` [Qemu-devel] [PULL 1/1] block/nvme: fix Coverity reports Fam Zheng
2018-03-01 14:43 ` [Qemu-devel] [PULL 0/1] Block patches 2018-03-01 Peter Maydell
0 siblings, 2 replies; 5+ messages in thread
From: Fam Zheng @ 2018-03-01 7:54 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell
The following changes since commit 6697439794f72b3501ee16bb95d16854f9981421:
Merge remote-tracking branch 'remotes/kraxel/tags/usb-20180227-pull-request' into staging (2018-02-27 17:50:46 +0000)
are available in the Git repository at:
git://github.com/famz/qemu.git tags/staging-pull-request
for you to fetch changes up to 78d8c99e297eba32897d8a5bdaa005670549d6f7:
block/nvme: fix Coverity reports (2018-03-01 15:21:46 +0800)
----------------------------------------------------------------
Coverity error fix for nvme://
----------------------------------------------------------------
Paolo Bonzini (1):
block/nvme: fix Coverity reports
block/nvme.c | 10 +++++++---
util/vfio-helpers.c | 2 +-
2 files changed, 8 insertions(+), 4 deletions(-)
--
2.14.3
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Qemu-devel] [PULL 1/1] block/nvme: fix Coverity reports
2018-03-01 7:54 [Qemu-devel] [PULL 0/1] Block patches 2018-03-01 Fam Zheng
@ 2018-03-01 7:54 ` Fam Zheng
2018-05-18 18:01 ` Peter Maydell
2018-03-01 14:43 ` [Qemu-devel] [PULL 0/1] Block patches 2018-03-01 Peter Maydell
1 sibling, 1 reply; 5+ messages in thread
From: Fam Zheng @ 2018-03-01 7:54 UTC (permalink / raw)
To: qemu-devel; +Cc: Peter Maydell
From: Paolo Bonzini <pbonzini@redhat.com>
1) string not null terminated in sysfs_find_group_file
2) NULL pointer dereference and dead local variable in nvme_init.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <20180213015240.9352-1-famz@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
---
block/nvme.c | 10 +++++++---
util/vfio-helpers.c | 2 +-
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/block/nvme.c b/block/nvme.c
index 10bffbbf2f..75078022f6 100644
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -645,7 +645,7 @@ static int nvme_init(BlockDriverState *bs, const char *device, int namespace,
aio_set_event_notifier(bdrv_get_aio_context(bs), &s->irq_notifier,
false, nvme_handle_event, nvme_poll_cb);
- nvme_identify(bs, namespace, errp);
+ nvme_identify(bs, namespace, &local_err);
if (local_err) {
error_propagate(errp, local_err);
ret = -EIO;
@@ -666,8 +666,12 @@ fail_queue:
nvme_free_queue_pair(bs, s->queues[0]);
fail:
g_free(s->queues);
- qemu_vfio_pci_unmap_bar(s->vfio, 0, (void *)s->regs, 0, NVME_BAR_SIZE);
- qemu_vfio_close(s->vfio);
+ if (s->regs) {
+ qemu_vfio_pci_unmap_bar(s->vfio, 0, (void *)s->regs, 0, NVME_BAR_SIZE);
+ }
+ if (s->vfio) {
+ qemu_vfio_close(s->vfio);
+ }
event_notifier_cleanup(&s->irq_notifier);
return ret;
}
diff --git a/util/vfio-helpers.c b/util/vfio-helpers.c
index f478b68400..006674c916 100644
--- a/util/vfio-helpers.c
+++ b/util/vfio-helpers.c
@@ -104,7 +104,7 @@ static char *sysfs_find_group_file(const char *device, Error **errp)
char *path = NULL;
sysfs_link = g_strdup_printf("/sys/bus/pci/devices/%s/iommu_group", device);
- sysfs_group = g_malloc(PATH_MAX);
+ sysfs_group = g_malloc0(PATH_MAX);
if (readlink(sysfs_link, sysfs_group, PATH_MAX - 1) == -1) {
error_setg_errno(errp, errno, "Failed to find iommu group sysfs path");
goto out;
--
2.14.3
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PULL 0/1] Block patches 2018-03-01
2018-03-01 7:54 [Qemu-devel] [PULL 0/1] Block patches 2018-03-01 Fam Zheng
2018-03-01 7:54 ` [Qemu-devel] [PULL 1/1] block/nvme: fix Coverity reports Fam Zheng
@ 2018-03-01 14:43 ` Peter Maydell
1 sibling, 0 replies; 5+ messages in thread
From: Peter Maydell @ 2018-03-01 14:43 UTC (permalink / raw)
To: Fam Zheng; +Cc: QEMU Developers
On 1 March 2018 at 07:54, Fam Zheng <famz@redhat.com> wrote:
> The following changes since commit 6697439794f72b3501ee16bb95d16854f9981421:
>
> Merge remote-tracking branch 'remotes/kraxel/tags/usb-20180227-pull-request' into staging (2018-02-27 17:50:46 +0000)
>
> are available in the Git repository at:
>
> git://github.com/famz/qemu.git tags/staging-pull-request
>
> for you to fetch changes up to 78d8c99e297eba32897d8a5bdaa005670549d6f7:
>
> block/nvme: fix Coverity reports (2018-03-01 15:21:46 +0800)
>
> ----------------------------------------------------------------
>
> Coverity error fix for nvme://
>
> ----------------------------------------------------------------
>
> Paolo Bonzini (1):
> block/nvme: fix Coverity reports
>
> block/nvme.c | 10 +++++++---
> util/vfio-helpers.c | 2 +-
> 2 files changed, 8 insertions(+), 4 deletions(-)
>
> --
Applied, thanks.
-- PMM
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PULL 1/1] block/nvme: fix Coverity reports
2018-03-01 7:54 ` [Qemu-devel] [PULL 1/1] block/nvme: fix Coverity reports Fam Zheng
@ 2018-05-18 18:01 ` Peter Maydell
2018-05-21 6:21 ` Fam Zheng
0 siblings, 1 reply; 5+ messages in thread
From: Peter Maydell @ 2018-05-18 18:01 UTC (permalink / raw)
To: Fam Zheng; +Cc: QEMU Developers
On 1 March 2018 at 07:54, Fam Zheng <famz@redhat.com> wrote:
> From: Paolo Bonzini <pbonzini@redhat.com>
>
> 1) string not null terminated in sysfs_find_group_file
>
> 2) NULL pointer dereference and dead local variable in nvme_init.
>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Fam Zheng <famz@redhat.com>
>
> Message-Id: <20180213015240.9352-1-famz@redhat.com>
> Signed-off-by: Fam Zheng <famz@redhat.com>
Hi. It looks like Coverity still doesn't like the error-exit
handling in nvme_init() (CID 1385847):
> ---
> block/nvme.c | 10 +++++++---
> util/vfio-helpers.c | 2 +-
> 2 files changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/block/nvme.c b/block/nvme.c
> index 10bffbbf2f..75078022f6 100644
> --- a/block/nvme.c
> +++ b/block/nvme.c
> @@ -645,7 +645,7 @@ static int nvme_init(BlockDriverState *bs, const char *device, int namespace,
> aio_set_event_notifier(bdrv_get_aio_context(bs), &s->irq_notifier,
> false, nvme_handle_event, nvme_poll_cb);
>
> - nvme_identify(bs, namespace, errp);
> + nvme_identify(bs, namespace, &local_err);
> if (local_err) {
> error_propagate(errp, local_err);
> ret = -EIO;
> @@ -666,8 +666,12 @@ fail_queue:
> nvme_free_queue_pair(bs, s->queues[0]);
> fail:
> g_free(s->queues);
> - qemu_vfio_pci_unmap_bar(s->vfio, 0, (void *)s->regs, 0, NVME_BAR_SIZE);
> - qemu_vfio_close(s->vfio);
> + if (s->regs) {
> + qemu_vfio_pci_unmap_bar(s->vfio, 0, (void *)s->regs, 0, NVME_BAR_SIZE);
We can get here with s->vfio being NULL and s->regs being
uninitialized, but qemu_vfio_pci_unmap_bar() will unconditionally
dereference s->vfio.
If you want to write the error path like this I think you need
to initialize s->regs = NULL before we do the qemu_vfio_open_pci()
call and error-check.
> + }
> + if (s->vfio) {
> + qemu_vfio_close(s->vfio);
> + }
> event_notifier_cleanup(&s->irq_notifier);
> return ret;
> }
thanks
-- PMM
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PULL 1/1] block/nvme: fix Coverity reports
2018-05-18 18:01 ` Peter Maydell
@ 2018-05-21 6:21 ` Fam Zheng
0 siblings, 0 replies; 5+ messages in thread
From: Fam Zheng @ 2018-05-21 6:21 UTC (permalink / raw)
To: Peter Maydell; +Cc: QEMU Developers
On Fri, 05/18 19:01, Peter Maydell wrote:
> On 1 March 2018 at 07:54, Fam Zheng <famz@redhat.com> wrote:
> > From: Paolo Bonzini <pbonzini@redhat.com>
> >
> > 1) string not null terminated in sysfs_find_group_file
> >
> > 2) NULL pointer dereference and dead local variable in nvme_init.
> >
> > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> > Signed-off-by: Fam Zheng <famz@redhat.com>
> >
> > Message-Id: <20180213015240.9352-1-famz@redhat.com>
> > Signed-off-by: Fam Zheng <famz@redhat.com>
>
> Hi. It looks like Coverity still doesn't like the error-exit
> handling in nvme_init() (CID 1385847):
>
> > ---
> > block/nvme.c | 10 +++++++---
> > util/vfio-helpers.c | 2 +-
> > 2 files changed, 8 insertions(+), 4 deletions(-)
> >
> > diff --git a/block/nvme.c b/block/nvme.c
> > index 10bffbbf2f..75078022f6 100644
> > --- a/block/nvme.c
> > +++ b/block/nvme.c
> > @@ -645,7 +645,7 @@ static int nvme_init(BlockDriverState *bs, const char *device, int namespace,
> > aio_set_event_notifier(bdrv_get_aio_context(bs), &s->irq_notifier,
> > false, nvme_handle_event, nvme_poll_cb);
> >
> > - nvme_identify(bs, namespace, errp);
> > + nvme_identify(bs, namespace, &local_err);
> > if (local_err) {
> > error_propagate(errp, local_err);
> > ret = -EIO;
> > @@ -666,8 +666,12 @@ fail_queue:
> > nvme_free_queue_pair(bs, s->queues[0]);
> > fail:
> > g_free(s->queues);
> > - qemu_vfio_pci_unmap_bar(s->vfio, 0, (void *)s->regs, 0, NVME_BAR_SIZE);
> > - qemu_vfio_close(s->vfio);
> > + if (s->regs) {
> > + qemu_vfio_pci_unmap_bar(s->vfio, 0, (void *)s->regs, 0, NVME_BAR_SIZE);
>
> We can get here with s->vfio being NULL and s->regs being
> uninitialized, but qemu_vfio_pci_unmap_bar() will unconditionally
> dereference s->vfio.
>
> If you want to write the error path like this I think you need
> to initialize s->regs = NULL before we do the qemu_vfio_open_pci()
> call and error-check.
Block layer uses g_malloc0 to allocate *s, so we expect s->regs is NULL to begin
with. But I can send a patch to explicitly initialize it to NULL to make the
code simpler to reason.
Fam
>
> > + }
> > + if (s->vfio) {
> > + qemu_vfio_close(s->vfio);
> > + }
> > event_notifier_cleanup(&s->irq_notifier);
> > return ret;
> > }
>
> thanks
> -- PMM
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-05-21 6:21 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-03-01 7:54 [Qemu-devel] [PULL 0/1] Block patches 2018-03-01 Fam Zheng
2018-03-01 7:54 ` [Qemu-devel] [PULL 1/1] block/nvme: fix Coverity reports Fam Zheng
2018-05-18 18:01 ` Peter Maydell
2018-05-21 6:21 ` Fam Zheng
2018-03-01 14:43 ` [Qemu-devel] [PULL 0/1] Block patches 2018-03-01 Peter Maydell
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.