[bug report] KVM: arm64: vgic-its: Add debugfs interface to expose ITS tables

[bug report] KVM: arm64: vgic-its: Add debugfs interface to expose ITS tables

[Dan Carpenter]

Hello Jing Zhang,

This is a semi-automatic email about new static checker warnings.

Commit 30deb51a677b ("KVM: arm64: vgic-its: Add debugfs interface to
expose ITS tables") from Feb 20, 2025, leads to the following Smatch
complaint:

    arch/arm64/kvm/vgic/vgic-debug.c:501 vgic_its_debug_show()
    warn: variable dereferenced before check 'ite' (see line 493)

arch/arm64/kvm/vgic/vgic-debug.c
   492	
   493		if (list_is_first(&ite->ite_list, &dev->itt_head)) {
                                   ^^^^^^^^^^^^^
This dereferences "ite"

   494			seq_printf(s, "\n");
   495			seq_printf(s, "Device ID: 0x%x, Event ID Range: [0 - %llu]\n",
   496				   dev->device_id, BIT_ULL(dev->num_eventid_bits) - 1);
   497			seq_printf(s, "EVENT_ID    INTID  HWINTID   TARGET   COL_ID HW\n");
   498			seq_printf(s, "-----------------------------------------------\n");
   499		}
   500	
   501		if (ite && ite->irq && ite->collection) {
                    ^^^
So this check is too late.

   502			seq_printf(s, "%8u %8u %8u %8u %8u %2d\n",
   503				   ite->event_id, ite->irq->intid, ite->irq->hwintid,

regards,
dan carpenter

Re: [bug report] KVM: arm64: vgic-its: Add debugfs interface to expose ITS tables

[Zenghui Yu]

Hi Dan,

On 2025/5/23 21:05, Dan Carpenter wrote:
> Hello Jing Zhang,
> 
> This is a semi-automatic email about new static checker warnings.
> 
> Commit 30deb51a677b ("KVM: arm64: vgic-its: Add debugfs interface to
> expose ITS tables") from Feb 20, 2025, leads to the following Smatch
> complaint:
> 
>     arch/arm64/kvm/vgic/vgic-debug.c:501 vgic_its_debug_show()
>     warn: variable dereferenced before check 'ite' (see line 493)
> 
> arch/arm64/kvm/vgic/vgic-debug.c
>    492	
>    493		if (list_is_first(&ite->ite_list, &dev->itt_head)) {
>                                    ^^^^^^^^^^^^^
> This dereferences "ite"

could be a NULL pointer dereference if, e.g., *no* interrupt has been
mapped into an ITE (associated with this device).

> 
>    494			seq_printf(s, "\n");
>    495			seq_printf(s, "Device ID: 0x%x, Event ID Range: [0 - %llu]\n",
>    496				   dev->device_id, BIT_ULL(dev->num_eventid_bits) - 1);
>    497			seq_printf(s, "EVENT_ID    INTID  HWINTID   TARGET   COL_ID HW\n");
>    498			seq_printf(s, "-----------------------------------------------\n");
>    499		}
>    500	
>    501		if (ite && ite->irq && ite->collection) {
>                     ^^^
> So this check is too late.

So this definitely needs to be fixed. Thanks for the report!

Zenghui