All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Dr. David Alan Gilbert (git)" <dgilbert@redhat.com>
To: qemu-devel@nongnu.org, leobras@redhat.com, thuth@redhat.com,
	peter.maydell@linaro.org, vgoyal@redhat.com
Cc: peterx@redhat.com, quintela@redhat.com
Subject: [PULL 3/5] migration: Assert that migrate_multifd_compression() returns an in-range value
Date: Tue,  2 Aug 2022 16:54:45 +0100	[thread overview]
Message-ID: <20220802155447.216018-4-dgilbert@redhat.com> (raw)
In-Reply-To: <20220802155447.216018-1-dgilbert@redhat.com>

From: Peter Maydell <peter.maydell@linaro.org>

Coverity complains that when we use the return value from
migrate_multifd_compression() as an array index:
  multifd_recv_state->ops = multifd_ops[migrate_multifd_compression()];

that this might overrun the array (which is declared to have size
MULTIFD_COMPRESSION__MAX).  This is because the function return type
is MultiFDCompression, which is an autogenerated enum.  The code
generator includes the "one greater than the maximum possible value"
MULTIFD_COMPRESSION__MAX in the enum, even though this is not
actually a valid value for the enum, and this makes Coverity think
that migrate_multifd_compression() could return that __MAX value and
index off the end of the array.

Suppress the Coverity error by asserting that the value we're going
to return is within range.

Resolves: Coverity CID 1487239, 1487254
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20220721115207.729615-2-peter.maydell@linaro.org>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
---
 migration/migration.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/migration/migration.c b/migration/migration.c
index 82fbe0cf55..bb8bbddfe4 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2617,6 +2617,7 @@ MultiFDCompression migrate_multifd_compression(void)
 
     s = migrate_get_current();
 
+    assert(s->parameters.multifd_compression < MULTIFD_COMPRESSION__MAX);
     return s->parameters.multifd_compression;
 }
 
-- 
2.37.1



  parent reply	other threads:[~2022-08-02 15:56 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-02 15:54 [PULL 0/5] migration queue Dr. David Alan Gilbert (git)
2022-08-02 15:54 ` [PULL 1/5] migration: add remaining params->has_* = true in migration_instance_init() Dr. David Alan Gilbert (git)
2022-08-02 15:54 ` [PULL 2/5] Revert "migration: Simplify unqueue_page()" Dr. David Alan Gilbert (git)
2022-08-02 15:54 ` Dr. David Alan Gilbert (git) [this message]
2022-08-02 15:54 ` [PULL 4/5] migration: Define BLK_MIG_BLOCK_SIZE as unsigned long long Dr. David Alan Gilbert (git)
2022-08-02 15:54 ` [PULL 5/5] virtiofsd: Disable killpriv_v2 by default Dr. David Alan Gilbert (git)
2022-08-02 19:12 ` [PULL 0/5] migration queue Richard Henderson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220802155447.216018-4-dgilbert@redhat.com \
    --to=dgilbert@redhat.com \
    --cc=leobras@redhat.com \
    --cc=peter.maydell@linaro.org \
    --cc=peterx@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=quintela@redhat.com \
    --cc=thuth@redhat.com \
    --cc=vgoyal@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.