linux-kernel - Re: [BUG ?] MIPS: KVM: condition with no effect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 5 May 2015 22:42:06 +0100
From:	James Hogan <james.hogan@...tec.com>
To:	Nicholas Mc Guire <der.herr@...r.at>
CC:	Gleb Natapov <gleb@...nel.org>,
	Paolo Bonzini <pbonzini@...hat.com>,
	Ralf Baechle <ralf@...ux-mips.org>, <kvm@...r.kernel.org>,
	<linux-mips@...ux-mips.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [BUG ?] MIPS: KVM: condition with no effect

Hi,

On Tue, May 05, 2015 at 02:34:38PM +0200, Nicholas Mc Guire wrote:
> 
> Hi !
> 
>  Not sure if this is a bug or maybe a placeholder for
>  something... so patch - but maybe someone that knows this code can
>  give it a look.
> 
> arch/mips/kvm/emulate.c:emulation_result kvm_mips_complete_mmio_load()    
> <snip>
> 2414         case 2:
> 2415                 if (vcpu->mmio_needed == 2)
> 2416                         *gpr = *(int16_t *) run->mmio.data;                
> 2417                 else
> 2418                         *gpr = *(int16_t *) run->mmio.data;
> 2419 
> 2420                 break;
> <snip>
> 
>  either the if/else is not needed or one of the branches is wrong
>  or it is a place-holder for somethign that did not get
>  done - in which case a few lines explaining this would be 
>  nice (e.g. like in arch/sh/kernel/traps_64.c line 59)
> 
>  line numbers refer to 4.1-rc2 

mmio_needed encodes whether the MMIO load is a signed (2) or unsigned
(1) load. E.g. the len == 1 case just below casts the pointer to u8 vs
int8_t to control sign extension. So it appears the else branch (line
2418 in your quote) should be uint16_t (or u16) to prevent the MMIO
value loaded by a lhu (load halfword unsigned) being sign extended to
the full width of the registers. Nice catch!

Feel free to send a patch to fix. Otherwise I'm happy to do it.

Thanks!
James

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)