linux-kernel - Re: [PATCH] KVM: x86: hyper-v: Fix 'using uninitialized value' Coverity warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 06 Dec 2022 14:53:04 +0100
From:   Vitaly Kuznetsov <vkuznets@...hat.com>
To:     Sean Christopherson <seanjc@...gle.com>
Cc:     kvm@...r.kernel.org, Paolo Bonzini <pbonzini@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>,
        Maxim Levitsky <mlevitsk@...hat.com>,
        coverity-bot <keescook@...omium.org>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] KVM: x86: hyper-v: Fix 'using uninitialized value'
 Coverity warning

Sean Christopherson <seanjc@...gle.com> writes:

> On Fri, Dec 02, 2022, Vitaly Kuznetsov wrote:
>> In kvm_hv_flush_tlb(), 'data_offset' and 'consumed_xmm_halves' variables
>> are used in a mutually exclusive way: in 'hc->fast' we count in 'XMM
>> halves' and increase 'data_offset' otherwise. Coverity discovered, that in
>> one case both variables are incremented unconditionally. This doesn't seem
>> to cause any issues as the only user of 'data_offset'/'consumed_xmm_halves'
>> data is kvm_hv_get_tlb_flush_entries() ->  kvm_hv_get_hc_data() which also
>> takes into account 'hc->fast' but is still worth fixing.
>
> If those calls aren't inlined, then 32-bit Hyper-V will be "consuming" uninitialized
> data when pushing parameters onto the stack.  It won't cause real problems, but
> checkers might complain.
>
> What about shoving this metadata into "struct kvm_hv_hcall" as a union?  That'd
> help convey that the two are mutually exclusive, would provide a place to document
> said exclusion, and would yield a nice cleanup too by eliminating multiple params
> from various functions.

"struct kvm_hv_hcall" used to hold raw data from the guest and
'consumed_xmm_halves'/ 'data_offset' are rather our implementation
details, how we consume these data. I don't see why we can't re-purpose
it a little bit to hold both, let me try that in v2.

-- 
Vitaly