xen-mfndump xch bug (was Re: New Defects reported by Coverity Scan for XenProject)

xen-mfndump xch bug (was Re: New Defects reported by Coverity Scan for XenProject)

[Ian Jackson]

scan-admin@coverity.com writes ("New Defects reported by Coverity Scan for XenProject"):
___________________________
> *** CID 1191885:  Dereference after null check  (FORWARD_NULL)
> /tools/misc/xen-mfndump.c: 401 in main()
> 400         xch = xc_interface_open(0, 0, 0);
> >>>     CID 1191885:  Dereference after null check  (FORWARD_NULL)
> >>>     Comparing "xch" to null implies that "xch" might be null.
> 401         if ( !xch )
> 402         {
> 403             ERROR("Failed to open an xc handler");

This complaint is accurate.  ERROR uses xch.  (This is IMO not a
security problem.)

Furthermore, I was rather startled to discover that xen-mfndump.c
#includes <xc_private.h>.

Thanks,
Ian.

Re: xen-mfndump xch bug (was Re: New Defects reported by Coverity Scan for XenProject)

[Dario Faggioli]

[-- Attachment #1.1: Type: text/plain, Size: 1501 bytes --]

On gio, 2014-03-13 at 17:05 +0000, Ian Jackson wrote:
> scan-admin@coverity.com writes ("New Defects reported by Coverity Scan for XenProject"):
> ___________________________
> > *** CID 1191885:  Dereference after null check  (FORWARD_NULL)
> > /tools/misc/xen-mfndump.c: 401 in main()
> > 400         xch = xc_interface_open(0, 0, 0);
> > >>>     CID 1191885:  Dereference after null check  (FORWARD_NULL)
> > >>>     Comparing "xch" to null implies that "xch" might be null.
> > 401         if ( !xch )
> > 402         {
> > 403             ERROR("Failed to open an xc handler");
> 
> This complaint is accurate.  ERROR uses xch.  (This is IMO not a
> security problem.)
> 
I think Andrew sent a patch (and its v2 also) about it already:
http://www.gossamer-threads.com/lists/xen/devel/320397

> Furthermore, I was rather startled to discover that xen-mfndump.c
> #includes <xc_private.h>.
> 
Makes sense... Sorry for that. I think I remember, when working on it,
starting from copying tools/misc/xen-hptool.c, and then modifying it for
my purposes. I probably just left the #include-s untouched without much
thinking.

Do you want me to try to remove it and send a patch to that effect?

Regards,
Dario

-- 
<<This happens because I choose it to happen!>> (Raistlin Majere)
-----------------------------------------------------------------
Dario Faggioli, Ph.D, http://about.me/dario.faggioli
Senior Software Engineer, Citrix Systems R&D Ltd., Cambridge (UK)


[-- Attachment #1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: xen-mfndump xch bug (was Re: New Defects reported by Coverity Scan for XenProject)

[Andrew Cooper]

[-- Attachment #1.1: Type: text/plain, Size: 923 bytes --]

On 13/03/14 17:19, Dario Faggioli wrote:
> On gio, 2014-03-13 at 17:05 +0000, Ian Jackson wrote:
>> scan-admin@coverity.com writes ("New Defects reported by Coverity
Scan for XenProject"):
>> ___________________________
>>> *** CID 1191885:  Dereference after null check  (FORWARD_NULL)
>>> /tools/misc/xen-mfndump.c: 401 in main()
>>> 400         xch = xc_interface_open(0, 0, 0);
>>>>>>     CID 1191885:  Dereference after null check  (FORWARD_NULL)
>>>>>>     Comparing "xch" to null implies that "xch" might be null.
>>> 401         if ( !xch )
>>> 402         {
>>> 403             ERROR("Failed to open an xc handler");
>>
>> This complaint is accurate.  ERROR uses xch.  (This is IMO not a
>> security problem.)
>>
> I think Andrew sent a patch (and its v2 also) about it already:
> http://www.gossamer-threads.com/lists/xen/devel/320397

Indeed I have - it has suitable acks and is pending committing now.

~Andrew

[-- Attachment #1.2: Type: text/html, Size: 1738 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: xen-mfndump xch bug (was Re: New Defects reported by Coverity Scan for XenProject)

[Ian Campbell]

On Thu, 2014-03-13 at 18:19 +0100, Dario Faggioli wrote:
> > Furthermore, I was rather startled to discover that xen-mfndump.c
> > #includes <xc_private.h>.
> > 
> Makes sense... Sorry for that. I think I remember, when working on it,
> starting from copying tools/misc/xen-hptool.c

(begs the question why this guy needs it too, oh well)

> , and then modifying it for
> my purposes. I probably just left the #include-s untouched without much
> thinking.
> 
> Do you want me to try to remove it and send a patch to that effect?

Yes Please.

> 
> Regards,
> Dario
> 

Re: xen-mfndump xch bug (was Re: New Defects reported by Coverity Scan for XenProject)

[Dario Faggioli]

[-- Attachment #1.1: Type: text/plain, Size: 975 bytes --]

On gio, 2014-03-13 at 17:35 +0000, Ian Campbell wrote:
> On Thu, 2014-03-13 at 18:19 +0100, Dario Faggioli wrote:
> > > Furthermore, I was rather startled to discover that xen-mfndump.c
> > > #includes <xc_private.h>.
> > > 
> > Makes sense... Sorry for that. I think I remember, when working on it,
> > starting from copying tools/misc/xen-hptool.c
> 
> (begs the question why this guy needs it too, oh well)
> 
Indeed. :-)

> > , and then modifying it for
> > my purposes. I probably just left the #include-s untouched without much
> > thinking.
> > 
> > Do you want me to try to remove it and send a patch to that effect?
> 
> Yes Please.
> 
I'll do, and try to kill both uses.

Dario

-- 
<<This happens because I choose it to happen!>> (Raistlin Majere)
-----------------------------------------------------------------
Dario Faggioli, Ph.D, http://about.me/dario.faggioli
Senior Software Engineer, Citrix Systems R&D Ltd., Cambridge (UK)


[-- Attachment #1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: xen-mfndump xch bug (was Re: New Defects reported by Coverity Scan for XenProject)

[Ian Jackson]

Dario Faggioli writes ("Re: xen-mfndump xch bug (was Re: New Defects reported by Coverity Scan for XenProject)"):
> On gio, 2014-03-13 at 17:05 +0000, Ian Jackson wrote:
> > Furthermore, I was rather startled to discover that xen-mfndump.c
> > #includes <xc_private.h>.
> > 
> Makes sense... Sorry for that. I think I remember, when working on it,
> starting from copying tools/misc/xen-hptool.c, and then modifying it for
> my purposes. I probably just left the #include-s untouched without much
> thinking.

Ah, that would explain it.

> Do you want me to try to remove it and send a patch to that effect?

Not unless you're feeling really bored :-).  Tidying up the in-tree
libxc callers is probably something we can put off...

Thanks,
Ian.

Re: xen-mfndump xch bug (was Re: New Defects reported by Coverity Scan for XenProject)

[Dario Faggioli]

[-- Attachment #1.1: Type: text/plain, Size: 722 bytes --]

On ven, 2014-03-14 at 11:37 +0000, Ian Jackson wrote:
> Dario Faggioli writes ("Re: xen-mfndump xch bug (was Re: New Defects reported by Coverity Scan for XenProject)"):
> > Do you want me to try to remove it and send a patch to that effect?
> 
> Not unless you're feeling really bored :-).  Tidying up the in-tree
> libxc callers is probably something we can put off...
> 
Right. Adding it to my "When really bored" TODO list :-)

Regards,
Dario

-- 
<<This happens because I choose it to happen!>> (Raistlin Majere)
-----------------------------------------------------------------
Dario Faggioli, Ph.D, http://about.me/dario.faggioli
Senior Software Engineer, Citrix Systems R&D Ltd., Cambridge (UK)


[-- Attachment #1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel