[PATCH] tools/libxc: Initialise parameters in map_p2m_list() for error paths

[PATCH] tools/libxc: Initialise parameters in map_p2m_list() for error paths

[Andrew Cooper]

c/s 7bf7458 "libxc: support of linear p2m list for migration of
pv-domains" breaks compilation on CentOS 7 because of 'ptes' being
possibly uninitialised after the 'err:' label.

The migration will fail early for conditions which would cause the for()
loop not to run, but the compiler doesn't know this.

Initialise the parameters to safe default to make the function more
robust.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
---
CC: Ian Campbell <Ian.Campbell@citrix.com>
CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
CC: Wei Liu <wei.liu2@citrix.com>
CC: Juergen Gross <jgross@suse.com>
---
 tools/libxc/xc_sr_save_x86_pv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/libxc/xc_sr_save_x86_pv.c b/tools/libxc/xc_sr_save_x86_pv.c
index 4deb58f..ab4bbe0 100644
--- a/tools/libxc/xc_sr_save_x86_pv.c
+++ b/tools/libxc/xc_sr_save_x86_pv.c
@@ -316,9 +316,9 @@ static int map_p2m_list(struct xc_sr_context *ctx, uint64_t p2m_cr3)
     xc_interface *xch = ctx->xch;
     xen_vaddr_t p2m_vaddr, p2m_end, mask, off;
     xen_pfn_t p2m_mfn, mfn, saved_mfn, max_pfn;
-    uint64_t *ptes;
+    uint64_t *ptes = NULL;
     xen_pfn_t *mfns;
-    unsigned fpp, n_pages, level, shift, idx_start, idx_end, idx, saved_idx;
+    unsigned fpp, n_pages = 0, level, shift, idx_start, idx_end, idx, saved_idx;
     int rc = -1;
 
     p2m_mfn = cr3_to_mfn(ctx, p2m_cr3);
-- 
2.1.4

Re: [PATCH] tools/libxc: Initialise parameters in map_p2m_list() for error paths

[Wei Liu]

On Thu, Jan 07, 2016 at 02:55:30PM +0000, Andrew Cooper wrote:
> c/s 7bf7458 "libxc: support of linear p2m list for migration of
> pv-domains" breaks compilation on CentOS 7 because of 'ptes' being
> possibly uninitialised after the 'err:' label.
> 
> The migration will fail early for conditions which would cause the for()
> loop not to run, but the compiler doesn't know this.
> 
> Initialise the parameters to safe default to make the function more
> robust.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Acked-by: Wei Liu <wei.liu2@citrix.com>

> ---
> CC: Ian Campbell <Ian.Campbell@citrix.com>
> CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
> CC: Wei Liu <wei.liu2@citrix.com>
> CC: Juergen Gross <jgross@suse.com>
> ---
>  tools/libxc/xc_sr_save_x86_pv.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/libxc/xc_sr_save_x86_pv.c b/tools/libxc/xc_sr_save_x86_pv.c
> index 4deb58f..ab4bbe0 100644
> --- a/tools/libxc/xc_sr_save_x86_pv.c
> +++ b/tools/libxc/xc_sr_save_x86_pv.c
> @@ -316,9 +316,9 @@ static int map_p2m_list(struct xc_sr_context *ctx, uint64_t p2m_cr3)
>      xc_interface *xch = ctx->xch;
>      xen_vaddr_t p2m_vaddr, p2m_end, mask, off;
>      xen_pfn_t p2m_mfn, mfn, saved_mfn, max_pfn;
> -    uint64_t *ptes;
> +    uint64_t *ptes = NULL;
>      xen_pfn_t *mfns;
> -    unsigned fpp, n_pages, level, shift, idx_start, idx_end, idx, saved_idx;
> +    unsigned fpp, n_pages = 0, level, shift, idx_start, idx_end, idx, saved_idx;
>      int rc = -1;
>  
>      p2m_mfn = cr3_to_mfn(ctx, p2m_cr3);
> -- 
> 2.1.4
> 

Re: [PATCH] tools/libxc: Initialise parameters in map_p2m_list() for error paths

[Ian Campbell]

On Thu, 2016-01-07 at 14:55 +0000, Andrew Cooper wrote:
> c/s 7bf7458 "libxc: support of linear p2m list for migration of
> pv-domains" breaks compilation on CentOS 7 because of 'ptes' being
> possibly uninitialised after the 'err:' label.
> 
> The migration will fail early for conditions which would cause the for()
> loop not to run, but the compiler doesn't know this.

Isn't the issue the malloc goto err path before the loop? Looks like that
should have the error behaviour from the earlier half of the function
rather than the latter.

There might also be a path if ctx->x86_pv.levels == 0, in which case the
loop will never run, that's the sort of thing which could be checked (or
even perhaps asserted) on entry to the function.

> Initialise the parameters to safe default to make the function more
> robust.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> ---
> CC: Ian Campbell <Ian.Campbell@citrix.com>
> CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
> CC: Wei Liu <wei.liu2@citrix.com>
> CC: Juergen Gross <jgross@suse.com>
> ---
>  tools/libxc/xc_sr_save_x86_pv.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/libxc/xc_sr_save_x86_pv.c
> b/tools/libxc/xc_sr_save_x86_pv.c
> index 4deb58f..ab4bbe0 100644
> --- a/tools/libxc/xc_sr_save_x86_pv.c
> +++ b/tools/libxc/xc_sr_save_x86_pv.c
> @@ -316,9 +316,9 @@ static int map_p2m_list(struct xc_sr_context *ctx,
> uint64_t p2m_cr3)
>      xc_interface *xch = ctx->xch;
>      xen_vaddr_t p2m_vaddr, p2m_end, mask, off;
>      xen_pfn_t p2m_mfn, mfn, saved_mfn, max_pfn;
> -    uint64_t *ptes;
> +    uint64_t *ptes = NULL;
>      xen_pfn_t *mfns;
> -    unsigned fpp, n_pages, level, shift, idx_start, idx_end, idx,
> saved_idx;
> +    unsigned fpp, n_pages = 0, level, shift, idx_start, idx_end, idx,
> saved_idx;
>      int rc = -1;
>  
>      p2m_mfn = cr3_to_mfn(ctx, p2m_cr3);

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [PATCH] tools/libxc: Initialise parameters in map_p2m_list() for error paths

[Juergen Gross]

On 07/01/16 16:06, Ian Campbell wrote:
> On Thu, 2016-01-07 at 14:55 +0000, Andrew Cooper wrote:
>> c/s 7bf7458 "libxc: support of linear p2m list for migration of
>> pv-domains" breaks compilation on CentOS 7 because of 'ptes' being
>> possibly uninitialised after the 'err:' label.
>>
>> The migration will fail early for conditions which would cause the for()
>> loop not to run, but the compiler doesn't know this.
> 
> Isn't the issue the malloc goto err path before the loop? Looks like that
> should have the error behaviour from the earlier half of the function
> rather than the latter.

Yes to both. OTOH with Andrew's patch the code behaves correctly.

> There might also be a path if ctx->x86_pv.levels == 0, in which case the
> loop will never run, that's the sort of thing which could be checked (or
> even perhaps asserted) on entry to the function.

As there is no function vector involved between setting levels and
consuming it I doubt this makes really sense.


Juergen

Re: [PATCH] tools/libxc: Initialise parameters in map_p2m_list() for error paths

[Andrew Cooper]

On 07/01/16 15:06, Ian Campbell wrote:
> On Thu, 2016-01-07 at 14:55 +0000, Andrew Cooper wrote:
>> c/s 7bf7458 "libxc: support of linear p2m list for migration of
>> pv-domains" breaks compilation on CentOS 7 because of 'ptes' being
>> possibly uninitialised after the 'err:' label.
>>
>> The migration will fail early for conditions which would cause the for()
>> loop not to run, but the compiler doesn't know this.
> Isn't the issue the malloc goto err path before the loop? Looks like that
> should have the error behaviour from the earlier half of the function
> rather than the latter.

So it is - I missed that one when looking the options.

>
> There might also be a path if ctx->x86_pv.levels == 0, in which case the
> loop will never run, that's the sort of thing which could be checked (or
> even perhaps asserted) on entry to the function.

I don't think asserting details like this is a scalable options.  Also,
it doesn't help the compilation error if someone ends up disabling
assert() by playing with NDEBUG.

All that is needed is an adjustment to the commit message IMO:

---8<---
tools/libxc: Initialise parameters in map_p2m_list() for error paths

c/s 7bf7458 "libxc: support of linear p2m list for migration of
pv-domains" breaks compilation on CentOS 7 because of 'ptes' being
possibly uninitialised after the 'err:' label.

Indeed, the malloc() failure path would end using 'ptes' while
uninitialised.  Initialise the parameters to safe defaults.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Re: [PATCH] tools/libxc: Initialise parameters in map_p2m_list() for error paths

[Ian Campbell]

On Thu, 2016-01-07 at 15:24 +0000, Andrew Cooper wrote:
> On 07/01/16 15:06, Ian Campbell wrote:
> > On Thu, 2016-01-07 at 14:55 +0000, Andrew Cooper wrote:
> > > c/s 7bf7458 "libxc: support of linear p2m list for migration of
> > > pv-domains" breaks compilation on CentOS 7 because of 'ptes' being
> > > possibly uninitialised after the 'err:' label.
> > > 
> > > The migration will fail early for conditions which would cause the
> > > for()
> > > loop not to run, but the compiler doesn't know this.
> > Isn't the issue the malloc goto err path before the loop? Looks like
> > that
> > should have the error behaviour from the earlier half of the function
> > rather than the latter.
> 
> So it is - I missed that one when looking the options.
> 
> > 
> > There might also be a path if ctx->x86_pv.levels == 0, in which case
> > the
> > loop will never run, that's the sort of thing which could be checked
> > (or
> > even perhaps asserted) on entry to the function.
> 
> I don't think asserting details like this is a scalable options.  Also,
> it doesn't help the compilation error if someone ends up disabling
> assert() by playing with NDEBUG.

It could be an error return instead (which is what I meant to suggest
without the parenthetical).

> All that is needed is an adjustment to the commit message IMO:

I can live with this.

> 
> ---8<---
> tools/libxc: Initialise parameters in map_p2m_list() for error paths
> 
> c/s 7bf7458 "libxc: support of linear p2m list for migration of
> pv-domains" breaks compilation on CentOS 7 because of 'ptes' being
> possibly uninitialised after the 'err:' label.
> 
> Indeed, the malloc() failure path would end using 'ptes' while
> uninitialised.  Initialise the parameters to safe defaults.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> 

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [PATCH] tools/libxc: Initialise parameters in map_p2m_list() for error paths

[Juergen Gross]

On 07/01/16 15:55, Andrew Cooper wrote:
> c/s 7bf7458 "libxc: support of linear p2m list for migration of
> pv-domains" breaks compilation on CentOS 7 because of 'ptes' being
> possibly uninitialised after the 'err:' label.
> 
> The migration will fail early for conditions which would cause the for()
> loop not to run, but the compiler doesn't know this.
> 
> Initialise the parameters to safe default to make the function more
> robust.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

Acked-by: Juergen Gross <jgross@suse.com>

Thanks for catching this.

Juergen

> ---
> CC: Ian Campbell <Ian.Campbell@citrix.com>
> CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
> CC: Wei Liu <wei.liu2@citrix.com>
> CC: Juergen Gross <jgross@suse.com>
> ---
>  tools/libxc/xc_sr_save_x86_pv.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/libxc/xc_sr_save_x86_pv.c b/tools/libxc/xc_sr_save_x86_pv.c
> index 4deb58f..ab4bbe0 100644
> --- a/tools/libxc/xc_sr_save_x86_pv.c
> +++ b/tools/libxc/xc_sr_save_x86_pv.c
> @@ -316,9 +316,9 @@ static int map_p2m_list(struct xc_sr_context *ctx, uint64_t p2m_cr3)
>      xc_interface *xch = ctx->xch;
>      xen_vaddr_t p2m_vaddr, p2m_end, mask, off;
>      xen_pfn_t p2m_mfn, mfn, saved_mfn, max_pfn;
> -    uint64_t *ptes;
> +    uint64_t *ptes = NULL;
>      xen_pfn_t *mfns;
> -    unsigned fpp, n_pages, level, shift, idx_start, idx_end, idx, saved_idx;
> +    unsigned fpp, n_pages = 0, level, shift, idx_start, idx_end, idx, saved_idx;
>      int rc = -1;
>  
>      p2m_mfn = cr3_to_mfn(ctx, p2m_cr3);
>