[Qemu-devel] [PATCH 0/3] Coverity fixes

[Qemu-devel] [PATCH 0/3] Coverity fixes

[Paul Durrant]

Paul Durrant (3):
  dataplane/xen-block: remove dead code
  xen-block: remove redundant assignment
  xen-block: report error condition from vbd_name_to_disk()

 hw/block/dataplane/xen-block.c |  5 +----
 hw/block/xen-block.c           | 24 ++++++++++++++++--------
 2 files changed, 17 insertions(+), 12 deletions(-)
---
Cc: Anthony Perard <anthony.perard@citrix.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Max Reitz <mreitz@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Stefano Stabellini <sstabellini@kernel.org>
-- 
2.20.1.2.gb21ebb6

[Qemu-devel] [PATCH 1/3] dataplane/xen-block: remove dead code

[Paul Durrant]

The if() statement is clearly bogus (dead code which should have been
cleaned up when grant mapping was removed).

Spotted by Coverity: CID 1398635

While in the neighbourhood, add a missing 'fall through' annotation.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
---
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Stefano Stabellini <sstabellini@kernel.org>
Cc: Anthony Perard <anthony.perard@citrix.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Max Reitz <mreitz@redhat.com>
---
 hw/block/dataplane/xen-block.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/hw/block/dataplane/xen-block.c b/hw/block/dataplane/xen-block.c
index c6a15da024..f1523c5b45 100644
--- a/hw/block/dataplane/xen-block.c
+++ b/hw/block/dataplane/xen-block.c
@@ -281,10 +281,6 @@ static void xen_block_complete_aio(void *opaque, int ret)
         break;
     case BLKIF_OP_WRITE:
     case BLKIF_OP_FLUSH_DISKCACHE:
-        if (!request->req.nr_segments) {
-            break;
-        }
-        break;
     default:
         break;
     }
@@ -298,6 +294,7 @@ static void xen_block_complete_aio(void *opaque, int ret)
         if (!request->req.nr_segments) {
             break;
         }
+        /* fall through */
     case BLKIF_OP_READ:
         if (request->status == BLKIF_RSP_OKAY) {
             block_acct_done(blk_get_stats(dataplane->blk), &request->acct);
-- 
2.20.1.2.gb21ebb6

Re: [Qemu-devel] [PATCH 1/3] dataplane/xen-block: remove dead code

[Philippe Mathieu-Daudé]

On 2/15/19 5:25 PM, Paul Durrant wrote:
> The if() statement is clearly bogus (dead code which should have been
> cleaned up when grant mapping was removed).

"... was removed in 06454c24ad)."

> 
> Spotted by Coverity: CID 1398635
> 
> While in the neighbourhood, add a missing 'fall through' annotation.
> 
> Reported-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
> ---
> Cc: Stefan Hajnoczi <stefanha@redhat.com>
> Cc: Stefano Stabellini <sstabellini@kernel.org>
> Cc: Anthony Perard <anthony.perard@citrix.com>
> Cc: Kevin Wolf <kwolf@redhat.com>
> Cc: Max Reitz <mreitz@redhat.com>
> ---
>  hw/block/dataplane/xen-block.c | 5 +----
>  1 file changed, 1 insertion(+), 4 deletions(-)
> 
> diff --git a/hw/block/dataplane/xen-block.c b/hw/block/dataplane/xen-block.c
> index c6a15da024..f1523c5b45 100644
> --- a/hw/block/dataplane/xen-block.c
> +++ b/hw/block/dataplane/xen-block.c
> @@ -281,10 +281,6 @@ static void xen_block_complete_aio(void *opaque, int ret)
>          break;
>      case BLKIF_OP_WRITE:
>      case BLKIF_OP_FLUSH_DISKCACHE:
> -        if (!request->req.nr_segments) {
> -            break;
> -        }
> -        break;
>      default:
>          break;
>      }
> @@ -298,6 +294,7 @@ static void xen_block_complete_aio(void *opaque, int ret)
>          if (!request->req.nr_segments) {
>              break;
>          }
> +        /* fall through */
>      case BLKIF_OP_READ:
>          if (request->status == BLKIF_RSP_OKAY) {
>              block_acct_done(blk_get_stats(dataplane->blk), &request->acct);
> 

Re: [Qemu-devel] [PATCH 1/3] dataplane/xen-block: remove dead code

[Anthony PERARD]

On Fri, Feb 15, 2019 at 09:38:59PM +0100, Philippe Mathieu-Daudé wrote:
> On 2/15/19 5:25 PM, Paul Durrant wrote:
> > The if() statement is clearly bogus (dead code which should have been
> > cleaned up when grant mapping was removed).
> 
> "... was removed in 06454c24ad)."

Actually, it looks like c6025bd197 should have remove the if statement.

> > 
> > Spotted by Coverity: CID 1398635
> > 
> > While in the neighbourhood, add a missing 'fall through' annotation.
> > 
> > Reported-by: Peter Maydell <peter.maydell@linaro.org>
> > Signed-off-by: Paul Durrant <paul.durrant@citrix.com>

Acked-by: Anthony PERARD <anthony.perard@citrix.com>

Thanks,

-- 
Anthony PERARD

[Qemu-devel] [PATCH 2/3] xen-block: remove redundant assignment

[Paul Durrant]

The assignment to 'p' is unnecessary as the code will either goto 'invalid'
or p will get overwritten.

Spotted by Coverity: CID 1398638

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
---
Cc: Stefano Stabellini <sstabellini@kernel.org>
Cc: Anthony Perard <anthony.perard@citrix.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Max Reitz <mreitz@redhat.com>
---
 hw/block/xen-block.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/block/xen-block.c b/hw/block/xen-block.c
index 5012af9cb6..29afe2703a 100644
--- a/hw/block/xen-block.c
+++ b/hw/block/xen-block.c
@@ -413,8 +413,7 @@ static void xen_block_set_vdev(Object *obj, Visitor *v, const char *name,
         }
 
         if (*end == 'p') {
-            p = (char *) ++end;
-            if (*end == '\0') {
+            if (*(++end) == '\0') {
                 goto invalid;
             }
         }
-- 
2.20.1.2.gb21ebb6

Re: [Qemu-devel] [PATCH 2/3] xen-block: remove redundant assignment

[Anthony PERARD]

On Fri, Feb 15, 2019 at 04:25:32PM +0000, Paul Durrant wrote:
> The assignment to 'p' is unnecessary as the code will either goto 'invalid'
> or p will get overwritten.
> 
> Spotted by Coverity: CID 1398638
> 
> Reported-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Paul Durrant <paul.durrant@citrix.com>

Acked-by: Anthony PERARD <anthony.perard@citrix.com>

-- 
Anthony PERARD

[Qemu-devel] [PATCH 3/3] xen-block: report error condition from vbd_name_to_disk()

[Paul Durrant]

The function needs to make sure it is passed a valid disk name. This is
easily done by making sure that the parsing loop results in a non-zero
value.

Spotted by Coverity: CID 1398640

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
---
Cc: Stefano Stabellini <sstabellini@kernel.org>
Cc: Anthony Perard <anthony.perard@citrix.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Max Reitz <mreitz@redhat.com>
---
 hw/block/xen-block.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/hw/block/xen-block.c b/hw/block/xen-block.c
index 29afe2703a..37a456c207 100644
--- a/hw/block/xen-block.c
+++ b/hw/block/xen-block.c
@@ -351,21 +351,28 @@ static void xen_block_get_vdev(Object *obj, Visitor *v, const char *name,
     g_free(str);
 }
 
-static unsigned int vbd_name_to_disk(const char *name, const char **endp)
+static int vbd_name_to_disk(const char *name, const char **endp,
+                            unsigned long *disk)
 {
-    unsigned int disk = 0;
+    unsigned int n = 0;
 
     while (*name != '\0') {
         if (!g_ascii_isalpha(*name) || !g_ascii_islower(*name)) {
             break;
         }
 
-        disk *= 26;
-        disk += *name++ - 'a' + 1;
+        n *= 26;
+        n += *name++ - 'a' + 1;
     }
     *endp = name;
 
-    return disk - 1;
+    if (!n) {
+        return -1;
+    }
+
+    *disk = n - 1;
+
+    return 0;
 }
 
 static void xen_block_set_vdev(Object *obj, Visitor *v, const char *name,
@@ -418,7 +425,9 @@ static void xen_block_set_vdev(Object *obj, Visitor *v, const char *name,
             }
         }
     } else {
-        vdev->disk = vbd_name_to_disk(p, &end);
+        if (vbd_name_to_disk(p, &end, &vdev->disk)) {
+            goto invalid;
+        }
     }
 
     if (*end != '\0') {
-- 
2.20.1.2.gb21ebb6

Re: [Qemu-devel] [PATCH 3/3] xen-block: report error condition from vbd_name_to_disk()

[Anthony PERARD]

On Fri, Feb 15, 2019 at 04:25:33PM +0000, Paul Durrant wrote:
> The function needs to make sure it is passed a valid disk name. This is
> easily done by making sure that the parsing loop results in a non-zero
> value.
> 
> Spotted by Coverity: CID 1398640
> 
> Reported-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Paul Durrant <paul.durrant@citrix.com>

Acked-by: Anthony PERARD <anthony.perard@citrix.com>

Thanks,

-- 
Anthony PERARD