linux-kernel - [bug report] VMCI: queue pairs implementation.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 22 Mar 2017 14:18:47 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     georgezhang@...are.com, Jorgen Hansen <jhansen@...are.com>,
        Andy King <acking@...are.com>
Cc:     linux-kernel@...r.kernel.org
Subject: [bug report] VMCI: queue pairs implementation.

Hello George Zhang,

The patch 06164d2b72aa: "VMCI: queue pairs implementation." from Jan
8, 2013, leads to the following static checker warning:

	drivers/misc/vmw_vmci/vmci_queue_pair.c:1850 qp_broker_alloc()
	warn: we tested 'is_local' before and it was 'false'

drivers/misc/vmw_vmci/vmci_queue_pair.c
  1779  static int qp_broker_alloc(struct vmci_handle handle,
  1780                             u32 peer,
  1781                             u32 flags,
  1782                             u32 priv_flags,
  1783                             u64 produce_size,
  1784                             u64 consume_size,
  1785                             struct vmci_qp_page_store *page_store,
  1786                             struct vmci_ctx *context,
  1787                             vmci_event_release_cb wakeup_cb,
  1788                             void *client_data,
  1789                             struct qp_broker_entry **ent,
  1790                             bool *swap)
  1791  {
  1792          const u32 context_id = vmci_ctx_get_id(context);
  1793          bool create;
  1794          struct qp_broker_entry *entry = NULL;
  1795          bool is_local = flags & VMCI_QPFLAG_LOCAL;
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Set here.

  1796          int result;
  1797  
  1798          if (vmci_handle_is_invalid(handle) ||
  1799              (flags & ~VMCI_QP_ALL_FLAGS) || is_local ||
                                                    ^^^^^^^^
If it's set then this function just returns an error.

  1800              !(produce_size || consume_size) ||
  1801              !context || context_id == VMCI_INVALID_ID ||
  1802              handle.context == VMCI_INVALID_ID) {
  1803                  return VMCI_ERROR_INVALID_ARGS;
  1804          }
  1805  
  1806          if (page_store && !VMCI_QP_PAGESTORE_IS_WELLFORMED(page_store))
  1807                  return VMCI_ERROR_INVALID_ARGS;
  1808  
  1809          /*
  1810           * In the initial argument check, we ensure that non-vmkernel hosts
  1811           * are not allowed to create local queue pairs.
  1812           */
  1813  
  1814          mutex_lock(&qp_broker_list.mutex);
  1815  
  1816          if (!is_local && vmci_ctx_qp_exists(context, handle)) {
                    ^^^^^^^^^
Tested.

  1817                  pr_devel("Context (ID=0x%x) already attached to queue pair (handle=0x%x:0x%x)\n",
  1818                           context_id, handle.context, handle.resource);
  1819                  mutex_unlock(&qp_broker_list.mutex);
  1820                  return VMCI_ERROR_ALREADY_EXISTS;
  1821          }
  1822  
  1823          if (handle.resource != VMCI_INVALID_ID)
  1824                  entry = qp_broker_handle_to_entry(handle);
  1825  
  1826          if (!entry) {
  1827                  create = true;
  1828                  result =
  1829                      qp_broker_create(handle, peer, flags, priv_flags,
  1830                                       produce_size, consume_size, page_store,
  1831                                       context, wakeup_cb, client_data, ent);
  1832          } else {
  1833                  create = false;
  1834                  result =
  1835                      qp_broker_attach(entry, peer, flags, priv_flags,
  1836                                       produce_size, consume_size, page_store,
  1837                                       context, wakeup_cb, client_data, ent);
  1838          }
  1839  
  1840          mutex_unlock(&qp_broker_list.mutex);
  1841  
  1842          if (swap)
  1843                  *swap = (context_id == VMCI_HOST_CONTEXT_ID) &&
  1844                      !(create && is_local);
                                        ^^^^^^^^
And tested again.

  1845  
  1846          return result;
  1847  }

regards,
dan carpenter