* [PATCH v2] libxc: fix leak of t_info in xc_tbuf_get_size() @ 2016-02-11 8:32 Harmandeep Kaur 2016-02-11 9:14 ` Dario Faggioli 2016-02-11 9:52 ` Ian Campbell 0 siblings, 2 replies; 6+ messages in thread From: Harmandeep Kaur @ 2016-02-11 8:32 UTC (permalink / raw) To: xen-devel Cc: wei.liu2, ian.campbell, stefano.stabellini, dario.faggioli, ian.jackson, Harmandeep Kaur Avoid leaking the memory mapping of the trace buffer Coverity ID 1351228 Signed-off-by: Harmandeep Kaur <write.harmandeep@gmail.com> --- v2: call to unmapping function reduced to one from two --- tools/libxc/xc_tbuf.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tools/libxc/xc_tbuf.c b/tools/libxc/xc_tbuf.c index 695939a..d96cc67 100644 --- a/tools/libxc/xc_tbuf.c +++ b/tools/libxc/xc_tbuf.c @@ -70,11 +70,13 @@ int xc_tbuf_get_size(xc_interface *xch, unsigned long *size) sysctl.u.tbuf_op.buffer_mfn); if ( t_info == NULL || t_info->tbuf_size == 0 ) - return -1; + rc = -1; + else + *size = t_info->tbuf_size; - *size = t_info->tbuf_size; + xenforeignmemory_unmap(xch->fmem, t_info, *size); - return 0; + return rc; } int xc_tbuf_enable(xc_interface *xch, unsigned long pages, unsigned long *mfn, -- 2.5.0 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] libxc: fix leak of t_info in xc_tbuf_get_size() 2016-02-11 8:32 [PATCH v2] libxc: fix leak of t_info in xc_tbuf_get_size() Harmandeep Kaur @ 2016-02-11 9:14 ` Dario Faggioli 2016-02-11 9:52 ` Ian Campbell 1 sibling, 0 replies; 6+ messages in thread From: Dario Faggioli @ 2016-02-11 9:14 UTC (permalink / raw) To: Harmandeep Kaur, xen-devel Cc: wei.liu2, ian.jackson, ian.campbell, stefano.stabellini [-- Attachment #1.1: Type: text/plain, Size: 561 bytes --] On Thu, 2016-02-11 at 14:02 +0530, Harmandeep Kaur wrote: > Avoid leaking the memory mapping of the trace buffer > > Coverity ID 1351228 > > Signed-off-by: Harmandeep Kaur <write.harmandeep@gmail.com> > Reviewed-by: Dario Faggioli <dario.faggioli@citrix.com> Thanks and Regards, Dario -- <<This happens because I choose it to happen!>> (Raistlin Majere) ----------------------------------------------------------------- Dario Faggioli, Ph.D, http://about.me/dario.faggioli Senior Software Engineer, Citrix Systems R&D Ltd., Cambridge (UK) [-- Attachment #1.2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 181 bytes --] [-- Attachment #2: Type: text/plain, Size: 126 bytes --] _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] libxc: fix leak of t_info in xc_tbuf_get_size() 2016-02-11 8:32 [PATCH v2] libxc: fix leak of t_info in xc_tbuf_get_size() Harmandeep Kaur 2016-02-11 9:14 ` Dario Faggioli @ 2016-02-11 9:52 ` Ian Campbell 2016-02-11 10:03 ` Dario Faggioli 1 sibling, 1 reply; 6+ messages in thread From: Ian Campbell @ 2016-02-11 9:52 UTC (permalink / raw) To: Harmandeep Kaur, xen-devel, George Dunlap Cc: wei.liu2, dario.faggioli, ian.jackson, stefano.stabellini Copying George since he maintains xentrace which this relates to. On Thu, 2016-02-11 at 14:02 +0530, Harmandeep Kaur wrote: > Avoid leaking the memory mapping of the trace buffer > > Coverity ID 1351228 > > Signed-off-by: Harmandeep Kaur <write.harmandeep@gmail.com> > --- > v2: call to unmapping function reduced to one from two > --- > tools/libxc/xc_tbuf.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/tools/libxc/xc_tbuf.c b/tools/libxc/xc_tbuf.c > index 695939a..d96cc67 100644 > --- a/tools/libxc/xc_tbuf.c > +++ b/tools/libxc/xc_tbuf.c > @@ -70,11 +70,13 @@ int xc_tbuf_get_size(xc_interface *xch, unsigned long > *size) > sysctl.u.tbuf_op.buffer_mfn); > > if ( t_info == NULL || t_info->tbuf_size == 0 ) > - return -1; > + rc = -1; > + else > + *size = t_info->tbuf_size; > > - *size = t_info->tbuf_size; > + xenforeignmemory_unmap(xch->fmem, t_info, *size); *size could be uninitialised here (in the error path) and even in the success case I don't think t_info->tbus_size is the right argument here, it needs to be the size which was passed to the map function, i.e. sysctl.u.tbuf_op.size. Ian. > > - return 0; > + return rc; > } > > int xc_tbuf_enable(xc_interface *xch, unsigned long pages, unsigned long > *mfn, _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] libxc: fix leak of t_info in xc_tbuf_get_size() 2016-02-11 9:52 ` Ian Campbell @ 2016-02-11 10:03 ` Dario Faggioli 2016-02-11 10:11 ` Ian Campbell 0 siblings, 1 reply; 6+ messages in thread From: Dario Faggioli @ 2016-02-11 10:03 UTC (permalink / raw) To: Ian Campbell, Harmandeep Kaur, xen-devel, George Dunlap Cc: wei.liu2, ian.jackson, stefano.stabellini [-- Attachment #1.1: Type: text/plain, Size: 1754 bytes --] On Thu, 2016-02-11 at 09:52 +0000, Ian Campbell wrote: > On Thu, 2016-02-11 at 14:02 +0530, Harmandeep Kaur wrote: > > > > diff --git a/tools/libxc/xc_tbuf.c b/tools/libxc/xc_tbuf.c > > index 695939a..d96cc67 100644 > > --- a/tools/libxc/xc_tbuf.c > > +++ b/tools/libxc/xc_tbuf.c > > @@ -70,11 +70,13 @@ int xc_tbuf_get_size(xc_interface *xch, > > unsigned long > > *size) > > sysctl.u.tbuf_op.buffer_mfn); > > > > if ( t_info == NULL || t_info->tbuf_size == 0 ) > > - return -1; > > + rc = -1; > > + else > > + *size = t_info->tbuf_size; > > > > - *size = t_info->tbuf_size; > > + xenforeignmemory_unmap(xch->fmem, t_info, *size); > > *size could be uninitialised here (in the error path) and even in the > success case I don't think t_info->tbus_size is the right argument > here, it > needs to be the size which was passed to the map function, i.e. > sysctl.u.tbuf_op.size. > And I think both are issues with the current code, and, more important, not what Coverity is complaining about in the referenced CID? To be clear, I'm not arguing that they're not issues we should fix (I don't know about the tbuf_size vs. tbuf_op.size, but I can check). I'm genuinely asking whether we should do that here, as compared to in a pre or follow up patch, and let this one be the one that placates Coverity on that particular issue. Regards, Dario -- <<This happens because I choose it to happen!>> (Raistlin Majere) ----------------------------------------------------------------- Dario Faggioli, Ph.D, http://about.me/dario.faggioli Senior Software Engineer, Citrix Systems R&D Ltd., Cambridge (UK) [-- Attachment #1.2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 181 bytes --] [-- Attachment #2: Type: text/plain, Size: 126 bytes --] _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] libxc: fix leak of t_info in xc_tbuf_get_size() 2016-02-11 10:03 ` Dario Faggioli @ 2016-02-11 10:11 ` Ian Campbell 2016-02-11 10:23 ` Dario Faggioli 0 siblings, 1 reply; 6+ messages in thread From: Ian Campbell @ 2016-02-11 10:11 UTC (permalink / raw) To: Dario Faggioli, Harmandeep Kaur, xen-devel, George Dunlap Cc: wei.liu2, ian.jackson, stefano.stabellini On Thu, 2016-02-11 at 11:03 +0100, Dario Faggioli wrote: > On Thu, 2016-02-11 at 09:52 +0000, Ian Campbell wrote: > > On Thu, 2016-02-11 at 14:02 +0530, Harmandeep Kaur wrote: > > > > > > diff --git a/tools/libxc/xc_tbuf.c b/tools/libxc/xc_tbuf.c > > > index 695939a..d96cc67 100644 > > > --- a/tools/libxc/xc_tbuf.c > > > +++ b/tools/libxc/xc_tbuf.c > > > @@ -70,11 +70,13 @@ int xc_tbuf_get_size(xc_interface *xch, > > > unsigned long > > > *size) > > > sysctl.u.tbuf_op.buffer_mfn); > > > > > > if ( t_info == NULL || t_info->tbuf_size == 0 ) > > > - return -1; > > > + rc = -1; > > > + else > > > + *size = t_info->tbuf_size; > > > > > > - *size = t_info->tbuf_size; > > > + xenforeignmemory_unmap(xch->fmem, t_info, *size); > > > > *size could be uninitialised here (in the error path) and even in the > > success case I don't think t_info->tbus_size is the right argument > > here, it > > needs to be the size which was passed to the map function, i.e. > > sysctl.u.tbuf_op.size. > > > And I think both are issues with the current code, I don't think so, the xenforeignmemory_unmap using *size as an argument (where it is either uninitialised or the wrong value) is added by this patch. > and, more important, > not what Coverity is complaining about in the referenced CID? > To be clear, I'm not arguing that they're not issues we should fix (I > don't know about the tbuf_size vs. tbuf_op.size, but I can check). I'm > genuinely asking whether we should do that here, as compared to in a > pre or follow up patch, and let this one be the one that placates > Coverity on that particular issue. Ian. _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] libxc: fix leak of t_info in xc_tbuf_get_size() 2016-02-11 10:11 ` Ian Campbell @ 2016-02-11 10:23 ` Dario Faggioli 0 siblings, 0 replies; 6+ messages in thread From: Dario Faggioli @ 2016-02-11 10:23 UTC (permalink / raw) To: Ian Campbell, Harmandeep Kaur, xen-devel, George Dunlap Cc: wei.liu2, ian.jackson, stefano.stabellini [-- Attachment #1.1: Type: text/plain, Size: 1939 bytes --] On Thu, 2016-02-11 at 10:11 +0000, Ian Campbell wrote: > On Thu, 2016-02-11 at 11:03 +0100, Dario Faggioli wrote: > > On Thu, 2016-02-11 at 09:52 +0000, Ian Campbell wrote: > > > On Thu, 2016-02-11 at 14:02 +0530, Harmandeep Kaur wrote: > > > > > > > > diff --git a/tools/libxc/xc_tbuf.c b/tools/libxc/xc_tbuf.c > > > > index 695939a..d96cc67 100644 > > > > --- a/tools/libxc/xc_tbuf.c > > > > +++ b/tools/libxc/xc_tbuf.c > > > > @@ -70,11 +70,13 @@ int xc_tbuf_get_size(xc_interface *xch, > > > > unsigned long > > > > *size) > > > > sysctl.u.tbuf_op.buffer_mfn); > > > > > > > > if ( t_info == NULL || t_info->tbuf_size == 0 ) > > > > - return -1; > > > > + rc = -1; > > > > + else > > > > + *size = t_info->tbuf_size; > > > > > > > > - *size = t_info->tbuf_size; > > > > + xenforeignmemory_unmap(xch->fmem, t_info, *size); > > > > > > *size could be uninitialised here (in the error path) and even in > > > the > > > success case I don't think t_info->tbus_size is the right > > > argument > > > here, it > > > needs to be the size which was passed to the map function, i.e. > > > sysctl.u.tbuf_op.size. > > > > > And I think both are issues with the current code, > > I don't think so, the xenforeignmemory_unmap using *size as an > argument > (where it is either uninitialised or the wrong value) is added by > this > patch. > Ah, that one! Yes, you're right, I had overlooked this, and thought you where referring to something else, sorry. I agree sysctl.u.tbuf_op.size is what should be used. Regards, Dario -- <<This happens because I choose it to happen!>> (Raistlin Majere) ----------------------------------------------------------------- Dario Faggioli, Ph.D, http://about.me/dario.faggioli Senior Software Engineer, Citrix Systems R&D Ltd., Cambridge (UK) [-- Attachment #1.2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 181 bytes --] [-- Attachment #2: Type: text/plain, Size: 126 bytes --] _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-02-11 10:23 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2016-02-11 8:32 [PATCH v2] libxc: fix leak of t_info in xc_tbuf_get_size() Harmandeep Kaur 2016-02-11 9:14 ` Dario Faggioli 2016-02-11 9:52 ` Ian Campbell 2016-02-11 10:03 ` Dario Faggioli 2016-02-11 10:11 ` Ian Campbell 2016-02-11 10:23 ` Dario Faggioli
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).