From mboxrd@z Thu Jan 1 00:00:00 1970 From: Borislav Petkov Subject: Re: [kvm:queue 6/21] arch/x86/kvm/cpuid.c:564:39: sparse: dereference of noderef expression Date: Wed, 6 Nov 2013 15:46:02 +0100 Message-ID: <20131106144602.GD16072@x1.alien8.de> References: <5274ceff.6z2MzJI/xOIjipuw%fengguang.wu@intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Cc: kbuild-all@01.org, kvm@vger.kernel.org To: kbuild test robot , Paolo Bonzini Return-path: Received: from cantor2.suse.de ([195.135.220.15]:39698 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750871Ab3KFRDu (ORCPT ); Wed, 6 Nov 2013 12:03:50 -0500 Content-Disposition: inline In-Reply-To: <5274ceff.6z2MzJI/xOIjipuw%fengguang.wu@intel.com> Sender: kvm-owner@vger.kernel.org List-ID: On Sat, Nov 02, 2013 at 06:07:59PM +0800, kbuild test robot wrote: > tree: git://git.kernel.org/pub/scm/virt/kvm/kvm.git queue > head: 81e87e26796782e014fd1f2bb9cd8fb6ce4021a8 > commit: 9c15bb1d0a8411f9bb3395d21d5309bde7da0c1c [6/21] kvm: Add KVM_GET_EMULATED_CPUID > reproduce: make C=1 CF=-D__CHECK_ENDIAN__ > > > sparse warnings: (new ones prefixed by >>) > > >> arch/x86/kvm/cpuid.c:564:39: sparse: dereference of noderef expression > >> arch/x86/kvm/cpuid.c:565:39: sparse: dereference of noderef expression > >> arch/x86/kvm/cpuid.c:566:39: sparse: dereference of noderef expression > > vim +564 arch/x86/kvm/cpuid.c > > 558 * > 559 * Sadly, this wasn't enforced for KVM_GET_SUPPORTED_CPUID and so we > 560 * have to give ourselves satisfied only with the emulated side. /me > 561 * sheds a tear. > 562 */ > 563 for (i = 0; i < num_entries; i++) { > > 564 if (entries[i].padding[0] || > 565 entries[i].padding[1] || > 566 entries[i].padding[2]) > 567 return true; > 568 } > 569 return false; Ok, how's that: -- From: Borislav Petkov Subject: [PATCH] kvm, cpuid: Fix sparse warning We need to copy padding to kernel space first before looking at it. Reported-by: kbuild test robot Signed-off-by: Borislav Petkov --- arch/x86/kvm/cpuid.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index 8f66fba804e4..c6976257eff5 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -564,6 +564,7 @@ static bool sanity_check_entries(struct kvm_cpuid_entry2 __user *entries, __u32 num_entries, unsigned int ioctl_type) { int i; + __u32 pad[3]; if (ioctl_type != KVM_GET_EMULATED_CPUID) return false; @@ -577,9 +578,10 @@ static bool sanity_check_entries(struct kvm_cpuid_entry2 __user *entries, * sheds a tear. */ for (i = 0; i < num_entries; i++) { - if (entries[i].padding[0] || - entries[i].padding[1] || - entries[i].padding[2]) + if (copy_from_user(pad, entries[i].padding, sizeof(pad))) + return true; + + if (pad[0] || pad[1] || pad[2]) return true; } return false; -- 1.8.0 -- Regards/Gruss, Boris.