| Message ID | 20210624180625.159495-1-seanjc@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: x86: Fix uninitialized return value bug in EXIT_HYPERCALL enabling | expand |
On 24/06/21 20:06, Sean Christopherson wrote: > Zero out 'r' on success in the KVM_CAP_EXIT_HYPERCALL case. As noted by > clang, the happy path will return an uninitialized value: > > arch/x86/kvm/x86.c:5649:7: error: variable 'r' is used uninitialized > whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] > if (cap->args[0] & ~KVM_EXIT_HYPERCALL_VALID_MASK) { > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > arch/x86/kvm/x86.c:5663:9: note: uninitialized use occurs here > return r; > ^ > arch/x86/kvm/x86.c:5649:3: note: remove the 'if' if its condition is always true > if (cap->args[0] & ~KVM_EXIT_HYPERCALL_VALID_MASK) { > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > arch/x86/kvm/x86.c:5540:7: note: initialize the variable 'r' to silence this warning > int r; > ^ > = 0 > > Opportunistically move the "r = -EINVAL;" above the check to match the > pattern used in almost all other cases. > > Fixes: 0dbb11230437 ("KVM: X86: Introduce KVM_HC_MAP_GPA_RANGE hypercall") > Signed-off-by: Sean Christopherson <seanjc@google.com> Actually it was not that patch, but rather a botched conflict resolution when applying (too late at night) Aaron's emulation failure patch: @@ -5647,6 +5648,9 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm, break; } kvm->arch.hypercall_exit_enabled = cap->args[0]; + break; + case KVM_CAP_EXIT_ON_EMULATION_FAILURE: + kvm->arch.exit_on_emulation_error = cap->args[0]; r = 0; break; default: I have already fixed this locally, though I haven't pushed it to kvm.git yet; my tests should finish running in about an hour, and then I'll push everything to kvm/next, except for the C bit fixes. Paolo > --- > arch/x86/kvm/x86.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c > index e4cea00c49a3..647922ba97df 100644 > --- a/arch/x86/kvm/x86.c > +++ b/arch/x86/kvm/x86.c > @@ -5646,11 +5646,12 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm, > r = kvm_x86_ops.vm_copy_enc_context_from(kvm, cap->args[0]); > return r; > case KVM_CAP_EXIT_HYPERCALL: > - if (cap->args[0] & ~KVM_EXIT_HYPERCALL_VALID_MASK) { > - r = -EINVAL; > + r = -EINVAL; > + if (cap->args[0] & ~KVM_EXIT_HYPERCALL_VALID_MASK) > break; > - } > + > kvm->arch.hypercall_exit_enabled = cap->args[0]; > + r = 0; > break; > case KVM_CAP_EXIT_ON_EMULATION_FAILURE: > kvm->arch.exit_on_emulation_error = cap->args[0]; >
On Thu, Jun 24, 2021 at 11:19 AM Paolo Bonzini <pbonzini@redhat.com> wrote: > > I have already fixed this locally, though I haven't pushed it to kvm.git > yet; my tests should finish running in about an hour, and then I'll push > everything to kvm/next, except for the C bit fixes. Ah, I was looking at this case in linux-next, and 0dbb11230437895f7cd6fc55da61cef011e997d8 wondering what was going on!
On Thu, Jun 24, 2021, Nick Desaulniers wrote: > On Thu, Jun 24, 2021 at 11:19 AM Paolo Bonzini <pbonzini@redhat.com> wrote: > > > > I have already fixed this locally, though I haven't pushed it to kvm.git > > yet; my tests should finish running in about an hour, and then I'll push > > everything to kvm/next, except for the C bit fixes. > > Ah, I was looking at this case in linux-next, and > 0dbb11230437895f7cd6fc55da61cef011e997d8 wondering what was going on! Doh, I obviously didn't look too closely at the blame.
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index e4cea00c49a3..647922ba97df 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -5646,11 +5646,12 @@ int kvm_vm_ioctl_enable_cap(struct kvm *kvm, r = kvm_x86_ops.vm_copy_enc_context_from(kvm, cap->args[0]); return r; case KVM_CAP_EXIT_HYPERCALL: - if (cap->args[0] & ~KVM_EXIT_HYPERCALL_VALID_MASK) { - r = -EINVAL; + r = -EINVAL; + if (cap->args[0] & ~KVM_EXIT_HYPERCALL_VALID_MASK) break; - } + kvm->arch.hypercall_exit_enabled = cap->args[0]; + r = 0; break; case KVM_CAP_EXIT_ON_EMULATION_FAILURE: kvm->arch.exit_on_emulation_error = cap->args[0];
Zero out 'r' on success in the KVM_CAP_EXIT_HYPERCALL case. As noted by clang, the happy path will return an uninitialized value: arch/x86/kvm/x86.c:5649:7: error: variable 'r' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] if (cap->args[0] & ~KVM_EXIT_HYPERCALL_VALID_MASK) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/x86/kvm/x86.c:5663:9: note: uninitialized use occurs here return r; ^ arch/x86/kvm/x86.c:5649:3: note: remove the 'if' if its condition is always true if (cap->args[0] & ~KVM_EXIT_HYPERCALL_VALID_MASK) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/x86/kvm/x86.c:5540:7: note: initialize the variable 'r' to silence this warning int r; ^ = 0 Opportunistically move the "r = -EINVAL;" above the check to match the pattern used in almost all other cases. Fixes: 0dbb11230437 ("KVM: X86: Introduce KVM_HC_MAP_GPA_RANGE hypercall") Signed-off-by: Sean Christopherson <seanjc@google.com> --- arch/x86/kvm/x86.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)