linux-kernel - Re: Possible bug in linux-6.2/tools/testing/selftests/powerpc/pmu/sampling_tests/mmcra_thresh_marked_sample

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 27 Feb 2023 16:26:01 +1100
From:   Michael Ellerman <mpe@...erman.id.au>
To:     David Binderman <dcb314@...mail.com>,
        "npiggin@...il.com" <npiggin@...il.com>,
        "christophe.leroy@...roup.eu" <christophe.leroy@...roup.eu>,
        "shuah@...nel.org" <shuah@...nel.org>,
        "linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>,
        "linux-kselftest@...r.kernel.org" <linux-kselftest@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: Possible bug in
 linux-6.2/tools/testing/selftests/powerpc/pmu/sampling_tests/mmcra_thresh_marked_sample_test.c

David Binderman <dcb314@...mail.com> writes:
> Hello there,
>
> I ran the static analyser cppcheck over the linux-6.2 source code and got this:
>
> linux-6.2/tools/testing/selftests/powerpc/pmu/sampling_tests/mmcra_thresh_marked_sample_test.c:68:10: style: Same expression '0x3' found multiple times in chain of '&' operators. [duplicateExpression]

Thanks.

> Source code is
>
>     FAIL_IF(EV_CODE_EXTRACT(event.attr.config, sample & 0x3) !=
>             get_mmcra_sample_mode(get_reg_value(intr_regs, "MMCRA"), 4));
>
> but
>
> #define EV_CODE_EXTRACT(x, y)   \
>     ((x >> ev_shift_##y) & ev_mask_##y)
>
>
> Given the token pasting, I very much doubt an expression like "sample & 0x3"
> will work correctly. Same thing on the line above 
>
>     FAIL_IF(EV_CODE_EXTRACT(event.attr.config, sample >> 2) !=
>             get_mmcra_rand_samp_elig(get_reg_value(intr_regs, "MMCRA"), 4));
>
> "sample >> 2" doesn't look like a valid token to me.

It expands to:

 if ((((event.attr.config >> ev_shift_sample >> 2) & ev_mask_sample >> 2) != get_mmcra_rand_samp_elig(get_reg_value(intr_regs, "MMCRA"), 4))) 

Which AFAICS is valid, and does compile.

Whether it's what the author actually intended is less clear.

And the other example with & 0x3 seems obviously wrong, it expands to:

  if ((((event.attr.config >> ev_shift_sample & 0x3) & ev_mask_sample & 0x3) != get_mmcra_sample_mode(get_reg_value(intr_regs, "MMCRA"), 4)))

The shift is 24, so bitwise anding it with 0x3 gets 0 which doesn't seem
likely to be what was intended.

cheers