[patch] /drivers/iommu/amd_iommu.c: variable unmap_size could be uninitialized

[patch] /drivers/iommu/amd_iommu.c: variable unmap_size could be uninitialized

[Yizhuo Zhai]

[-- Attachment #1.1: Type: text/plain, Size: 992 bytes --]

Variable "unmap_size" is supposed to be initialized in function fetch_pte.
However, it's uninitialized if fetch_pte returns NULL. And "unmap_size" is
used outside the return check.

>From 377ccb647d3c6c6747f20a242b035bafc775c3be Mon Sep 17 00:00:00 2001

Signed-off-by: From: "yzhai003-3vSkeFsW7jA@public.gmane.org" <yzhai003-3vSkeFsW7jA@public.gmane.org>
---
 drivers/iommu/amd_iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index 8fb8c73..774e057 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -1500,7 +1500,7 @@ static unsigned long iommu_unmap_page(struct
protection_domain *dom,
       unsigned long page_size)
 {
  unsigned long long unmapped;
- unsigned long unmap_size;
+ unsigned long unmap_size = 0;
  u64 *pte;

  BUG_ON(!is_power_of_2(page_size));
-- 
2.7.4


-- 
Kind Regards,

*Yizhuo Zhai*

*Computer Science, Graduate Student*
*University of California, Riverside *

[-- Attachment #1.2: Type: text/html, Size: 2225 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: [patch] /drivers/iommu/amd_iommu.c: variable unmap_size could be uninitialized

[Joerg Roedel]

Hi Yizhuo Zhai,

thanks for your patch, but I think there is a better way to fix that.
Please see below.

On Wed, May 30, 2018 at 11:02:54PM -0700, Yizhuo Zhai wrote:
> Variable "unmap_size" is supposed to be initialized in function fetch_pte.
> However, it's uninitialized if fetch_pte returns NULL. And "unmap_size" is used
> outside the return check. 
> 
> From 377ccb647d3c6c6747f20a242b035bafc775c3be Mon Sep 17 00:00:00 2001
> 
> Signed-off-by: From: "yzhai003@ucr.edu" <yzhai003@ucr.edu>
> ---
>  drivers/iommu/amd_iommu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
> index 8fb8c73..774e057 100644
> --- a/drivers/iommu/amd_iommu.c
> +++ b/drivers/iommu/amd_iommu.c
> @@ -1500,7 +1500,7 @@ static unsigned long iommu_unmap_page(struct
> protection_domain *dom,
>        unsigned long page_size)
>  {
>   unsigned long long unmapped;
> - unsigned long unmap_size;
> + unsigned long unmap_size = 0;

That is not sufficient because fetch_pte is called in a loop, and when
it returns NULL then unmap_size keeps the value of the previous
invocation.

So from looking at the code, it is better to set page_size=0 in
fetch_pte at the very beginning, before the function can return NULL.


Thanks,

	Joerg

Re: [patch] /drivers/iommu/amd_iommu.c: variable unmap_size could be uninitialized

[Yizhuo Zhai]

[-- Attachment #1.1: Type: text/plain, Size: 1689 bytes --]

Yes, thank you for your advice. The new patch's been sent.

On Thu, May 31, 2018 at 2:44 AM, Joerg Roedel <joro-zLv9SwRftAIdnm+yROfE0A@public.gmane.org> wrote:

> Hi Yizhuo Zhai,
>
> thanks for your patch, but I think there is a better way to fix that.
> Please see below.
>
> On Wed, May 30, 2018 at 11:02:54PM -0700, Yizhuo Zhai wrote:
> > Variable "unmap_size" is supposed to be initialized in function
> fetch_pte.
> > However, it's uninitialized if fetch_pte returns NULL. And "unmap_size"
> is used
> > outside the return check.
> >
> > From 377ccb647d3c6c6747f20a242b035bafc775c3be Mon Sep 17 00:00:00 2001
> >
> > Signed-off-by: From: "yzhai003-3vSkeFsW7jA@public.gmane.org" <yzhai003-3vSkeFsW7jA@public.gmane.org>
> > ---
> >  drivers/iommu/amd_iommu.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
> > index 8fb8c73..774e057 100644
> > --- a/drivers/iommu/amd_iommu.c
> > +++ b/drivers/iommu/amd_iommu.c
> > @@ -1500,7 +1500,7 @@ static unsigned long iommu_unmap_page(struct
> > protection_domain *dom,
> >        unsigned long page_size)
> >  {
> >   unsigned long long unmapped;
> > - unsigned long unmap_size;
> > + unsigned long unmap_size = 0;
>
> That is not sufficient because fetch_pte is called in a loop, and when
> it returns NULL then unmap_size keeps the value of the previous
> invocation.
>
> So from looking at the code, it is better to set page_size=0 in
> fetch_pte at the very beginning, before the function can return NULL.
>
>
> Thanks,
>
>         Joerg
>
>


-- 
Kind Regards,

*Yizhuo Zhai*

*Computer Science, Graduate Student*
*University of California, Riverside *

[-- Attachment #1.2: Type: text/html, Size: 2767 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]