* Uninitialised issue in hvmemul_do_io()
@ 2014-05-22 10:27 Andrew Cooper
2014-05-22 10:36 ` Paul Durrant
0 siblings, 1 reply; 2+ messages in thread
From: Andrew Cooper @ 2014-05-22 10:27 UTC (permalink / raw)
To: Paul Durrant; +Cc: Xen-devel List
Hello,
The latest Coverity run identified an issue in hvmemul_do_io()
ioreq_t p; is declared without initialiser.
By following the false branches, it is possible to get to line 230 of
hvm/emulate.c in the X86EMUL_UNHANDLEABLE case and call
hvm_send_assist_req() with a still uninitialised p.
This is Coverity-ID 1215178
~Andrew
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Uninitialised issue in hvmemul_do_io()
2014-05-22 10:27 Uninitialised issue in hvmemul_do_io() Andrew Cooper
@ 2014-05-22 10:36 ` Paul Durrant
0 siblings, 0 replies; 2+ messages in thread
From: Paul Durrant @ 2014-05-22 10:36 UTC (permalink / raw)
To: Andrew Cooper; +Cc: Xen-devel List
> -----Original Message-----
> From: Andrew Cooper
> Sent: 22 May 2014 11:28
> To: Paul Durrant
> Cc: Xen-devel List
> Subject: Uninitialised issue in hvmemul_do_io()
>
> Hello,
>
> The latest Coverity run identified an issue in hvmemul_do_io()
>
> ioreq_t p; is declared without initialiser.
>
> By following the false branches, it is possible to get to line 230 of
> hvm/emulate.c in the X86EMUL_UNHANDLEABLE case and call
> hvm_send_assist_req() with a still uninitialised p.
>
> This is Coverity-ID 1215178
>
All relevant fields of ioreq_t are initialized between lines 182 and 189 but hvm_send_assist_req() does a struct copy so the unitialized value of vp_eport is seen as a problem, which it's not because it gets overwritten in the destination by the correct value afterwards.
I will submit patch to just init all fields to 0 to get rid of the noise though.
Paul
> ~Andrew
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-05-22 10:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-05-22 10:27 Uninitialised issue in hvmemul_do_io() Andrew Cooper
2014-05-22 10:36 ` Paul Durrant
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.