linux-kernel - Re: [BUG ?] MIPS: KVM: condition with no effect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20150507121835.GA23830@opentech.at>
Date:	Thu, 7 May 2015 14:18:35 +0200
From:	Nicholas Mc Guire <der.herr@...r.at>
To:	James Hogan <james.hogan@...tec.com>
Cc:	Gleb Natapov <gleb@...nel.org>,
	Paolo Bonzini <pbonzini@...hat.com>,
	Ralf Baechle <ralf@...ux-mips.org>, kvm@...r.kernel.org,
	linux-mips@...ux-mips.org, linux-kernel@...r.kernel.org
Subject: Re: [BUG ?] MIPS: KVM: condition with no effect

On Tue, 05 May 2015, James Hogan wrote:

> Hi,
> 
> On Tue, May 05, 2015 at 02:34:38PM +0200, Nicholas Mc Guire wrote:
> > 
> > Hi !
> > 
> >  Not sure if this is a bug or maybe a placeholder for
> >  something... so patch - but maybe someone that knows this code can
> >  give it a look.
> > 
> > arch/mips/kvm/emulate.c:emulation_result kvm_mips_complete_mmio_load()    
> > <snip>
> > 2414         case 2:
> > 2415                 if (vcpu->mmio_needed == 2)
> > 2416                         *gpr = *(int16_t *) run->mmio.data;                
> > 2417                 else
> > 2418                         *gpr = *(int16_t *) run->mmio.data;
> > 2419 
> > 2420                 break;
> > <snip>
> > 
> >  either the if/else is not needed or one of the branches is wrong
> >  or it is a place-holder for somethign that did not get
> >  done - in which case a few lines explaining this would be 
> >  nice (e.g. like in arch/sh/kernel/traps_64.c line 59)
> > 
> >  line numbers refer to 4.1-rc2 
> 
> mmio_needed encodes whether the MMIO load is a signed (2) or unsigned
> (1) load. E.g. the len == 1 case just below casts the pointer to u8 vs
> int8_t to control sign extension. So it appears the else branch (line
> 2418 in your quote) should be uint16_t (or u16) to prevent the MMIO
> value loaded by a lhu (load halfword unsigned) being sign extended to
> the full width of the registers. Nice catch!
>
thanks for the clarification - will send the patch out shortly.

This was found by a trivial coccinelle scanner

<snip>
virtual context
virtual org
virtual report

@cond@
position p;
statement S1;
@@

<+...
* if@p (...) S1 else S1
...+>

@script:python@
p << cond.p;
@@

print "%s:%s WARNING: condition with no effect (if branch == else)" % (p[0].file,p[0].line)                                                                     
<snip>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/