From patchwork Wed Nov 6 14:46:02 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Borislav Petkov X-Patchwork-Id: 3148371 Return-Path: X-Original-To: patchwork-kvm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 0BC7D9F407 for ; Wed, 6 Nov 2013 17:04:16 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 3D9B72053B for ; Wed, 6 Nov 2013 17:04:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 858C820523 for ; Wed, 6 Nov 2013 17:04:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754715Ab3KFRDv (ORCPT ); Wed, 6 Nov 2013 12:03:51 -0500 Received: from cantor2.suse.de ([195.135.220.15]:39698 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750871Ab3KFRDu (ORCPT ); Wed, 6 Nov 2013 12:03:50 -0500 Received: from relay2.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id C0B23A6F5A; Wed, 6 Nov 2013 18:03:48 +0100 (CET) Received: by x1.localdomain (Postfix, from userid 1000) id D4114AA1AE; Wed, 6 Nov 2013 15:46:02 +0100 (CET) Date: Wed, 6 Nov 2013 15:46:02 +0100 From: Borislav Petkov To: kbuild test robot , Paolo Bonzini Cc: kbuild-all@01.org, kvm@vger.kernel.org Subject: Re: [kvm:queue 6/21] arch/x86/kvm/cpuid.c:564:39: sparse: dereference of noderef expression Message-ID: <20131106144602.GD16072@x1.alien8.de> References: <5274ceff.6z2MzJI/xOIjipuw%fengguang.wu@intel.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <5274ceff.6z2MzJI/xOIjipuw%fengguang.wu@intel.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Sat, Nov 02, 2013 at 06:07:59PM +0800, kbuild test robot wrote: > tree: git://git.kernel.org/pub/scm/virt/kvm/kvm.git queue > head: 81e87e26796782e014fd1f2bb9cd8fb6ce4021a8 > commit: 9c15bb1d0a8411f9bb3395d21d5309bde7da0c1c [6/21] kvm: Add KVM_GET_EMULATED_CPUID > reproduce: make C=1 CF=-D__CHECK_ENDIAN__ > > > sparse warnings: (new ones prefixed by >>) > > >> arch/x86/kvm/cpuid.c:564:39: sparse: dereference of noderef expression > >> arch/x86/kvm/cpuid.c:565:39: sparse: dereference of noderef expression > >> arch/x86/kvm/cpuid.c:566:39: sparse: dereference of noderef expression > > vim +564 arch/x86/kvm/cpuid.c > > 558 * > 559 * Sadly, this wasn't enforced for KVM_GET_SUPPORTED_CPUID and so we > 560 * have to give ourselves satisfied only with the emulated side. /me > 561 * sheds a tear. > 562 */ > 563 for (i = 0; i < num_entries; i++) { > > 564 if (entries[i].padding[0] || > 565 entries[i].padding[1] || > 566 entries[i].padding[2]) > 567 return true; > 568 } > 569 return false; Ok, how's that: --- From: Borislav Petkov Subject: [PATCH] kvm, cpuid: Fix sparse warning We need to copy padding to kernel space first before looking at it. Reported-by: kbuild test robot Signed-off-by: Borislav Petkov --- arch/x86/kvm/cpuid.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index 8f66fba804e4..c6976257eff5 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -564,6 +564,7 @@ static bool sanity_check_entries(struct kvm_cpuid_entry2 __user *entries, __u32 num_entries, unsigned int ioctl_type) { int i; + __u32 pad[3]; if (ioctl_type != KVM_GET_EMULATED_CPUID) return false; @@ -577,9 +578,10 @@ static bool sanity_check_entries(struct kvm_cpuid_entry2 __user *entries, * sheds a tear. */ for (i = 0; i < num_entries; i++) { - if (entries[i].padding[0] || - entries[i].padding[1] || - entries[i].padding[2]) + if (copy_from_user(pad, entries[i].padding, sizeof(pad))) + return true; + + if (pad[0] || pad[1] || pad[2]) return true; } return false;