linux-kernel - Re: [PATCH] ALSA: virtio: Fix "Coverity: virtsnd_kctl_tlv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID:
 <FR3P281MB25272BA9CC886E270EEAE380E64E2@FR3P281MB2527.DEUP281.PROD.OUTLOOK.COM>
Date: Wed, 14 Feb 2024 09:08:26 +0000
From: Aiswarya Cyriac <Aiswarya.Cyriac@...nsynergy.com>
To: "Michael S. Tsirkin" <mst@...hat.com>
CC: "jasowang@...hat.com" <jasowang@...hat.com>, "perex@...ex.cz"
	<perex@...ex.cz>, "tiwai@...e.com" <tiwai@...e.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"alsa-devel@...a-project.org" <alsa-devel@...a-project.org>,
	"virtualization@...ts.linux-foundation.org"
	<virtualization@...ts.linux-foundation.org>,
	"virtio-dev@...ts.oasis-open.org" <virtio-dev@...ts.oasis-open.org>, Anton
 Yakovlev <Anton.Yakovlev@...nsynergy.com>, coverity-bot
	<keescook+coverity-bot@...omium.org>, Mikhail Golubev-Ciuchea
	<Mikhail.Golubev-Ciuchea@...nsynergy.com>
Subject: Re: [PATCH] ALSA: virtio: Fix "Coverity: virtsnd_kctl_tlv_op():
 Uninitialized variables" warning.

Hi Michael,

Thank you for reviewing. I have updated my response inline

On Tue, Feb 13, 2024 at 09:51:30AM +0100, Aiswarya Cyriac wrote:
>> Fix the following warning when building virtio_snd driver.
>>
>> "
>> *** CID 1583619:  Uninitialized variables  (UNINIT)
>> sound/virtio/virtio_kctl.c:294 in virtsnd_kctl_tlv_op()
>> 288
>> 289         break;
>> 290       }
>> 291
>> 292       kfree(tlv);
>> 293
>> vvv     CID 1583619:  Uninitialized variables  (UNINIT)
>> vvv     Using uninitialized value "rc".
>> 294       return rc;
>> 295     }
>> 296
>> 297     /**
>> 298      * virtsnd_kctl_get_enum_items() - Query items for the ENUMERATED element type.
>> 299      * @snd: VirtIO sound device.
>> "
>>
>> Signed-off-by: Anton Yakovlev <anton.yakovlev@...nsynergy.com>
>> Signed-off-by: Aiswarya Cyriac <aiswarya.cyriac@...nsynergy.com>
>> Reported-by: coverity-bot <keescook+coverity-bot@...omium.org>
>> Addresses-Coverity-ID: 1583619 ("Uninitialized variables")
>> Fixes: d6568e3de42d ("ALSA: virtio: add support for audio controls")

>I don't know enough about ALSA to say whether the patch is correct.  But
>the commit log needs work: please, do not "fix warnings" - analyse the
>code and explain whether there is a real issue and if yes what is it
>and how it can trigger. Is an invalid op_flag ever passed?
>If it's just a coverity false positive it might be ok to
>work around that but document this.

This warning is caused by the absence of the "default" branch in the
switch-block, and is a false positive because the kernel calls
virtsnd_kctl_tlv_op() only with values for op_flag processed in
this block.
I will update the fix and send a v2 patch

>> ---
>>  sound/virtio/virtio_kctl.c | 5 +++++
>>  1 file changed, 5 insertions(+)
>>
>> diff --git a/sound/virtio/virtio_kctl.c b/sound/virtio/virtio_kctl.c
>> index 0c6ac74aca1e..d7a160c5db03 100644
>> --- a/sound/virtio/virtio_kctl.c
>> +++ b/sound/virtio/virtio_kctl.c
>> @@ -286,6 +286,11 @@ static int virtsnd_kctl_tlv_op(struct snd_kcontrol *kcontrol, int op_flag,
>>                else
>>                        rc = virtsnd_ctl_msg_send(snd, msg, &sg, NULL, false);
>>
>> +             break;
>> +     default:
>> +             virtsnd_ctl_msg_unref(msg);
>> +             rc = -EINVAL;
>> +

>There's already virtsnd_ctl_msg_unref call above.
>Also don't we need virtsnd_ctl_msg_unref on other error paths
>such as EFAULT?
>Unify error handling to fix it all then?

This also need to be handled and virtsnd_ctl_msg_unref needed in case of EFAULT as well.
I will update the patch.


Thanks,
Aiswarya Cyriac
Software Engineer

OpenSynergy GmbH
Rotherstr. 20, 10245 Berlin

EMail: aiswarya.cyriac@...nsynergy.com

www.opensynergy.com
Handelsregister/Commercial Registry: Amtsgericht Charlottenburg, HRB 108616B
Geschäftsführer/Managing Director: Régis Adjamah

________________________________________
From: Michael S. Tsirkin <mst@...hat.com>
Sent: Tuesday, February 13, 2024 10:06 AM
To: Aiswarya Cyriac
Cc: jasowang@...hat.com; perex@...ex.cz; tiwai@...e.com; linux-kernel@...r.kernel.org; alsa-devel@...a-project.org; virtualization@...ts.linux-foundation.org; virtio-dev@...ts.oasis-open.org; Anton Yakovlev; coverity-bot
Subject: Re: [PATCH] ALSA: virtio: Fix "Coverity: virtsnd_kctl_tlv_op(): Uninitialized variables" warning.

On Tue, Feb 13, 2024 at 09:51:30AM +0100, Aiswarya Cyriac wrote:
> Fix the following warning when building virtio_snd driver.
>
> "
> *** CID 1583619:  Uninitialized variables  (UNINIT)
> sound/virtio/virtio_kctl.c:294 in virtsnd_kctl_tlv_op()
> 288
> 289         break;
> 290       }
> 291
> 292       kfree(tlv);
> 293
> vvv     CID 1583619:  Uninitialized variables  (UNINIT)
> vvv     Using uninitialized value "rc".
> 294       return rc;
> 295     }
> 296
> 297     /**
> 298      * virtsnd_kctl_get_enum_items() - Query items for the ENUMERATED element type.
> 299      * @snd: VirtIO sound device.
> "
>
> Signed-off-by: Anton Yakovlev <anton.yakovlev@...nsynergy.com>
> Signed-off-by: Aiswarya Cyriac <aiswarya.cyriac@...nsynergy.com>
> Reported-by: coverity-bot <keescook+coverity-bot@...omium.org>
> Addresses-Coverity-ID: 1583619 ("Uninitialized variables")
> Fixes: d6568e3de42d ("ALSA: virtio: add support for audio controls")

I don't know enough about ALSA to say whether the patch is correct.  But
the commit log needs work: please, do not "fix warnings" - analyse the
code and explain whether there is a real issue and if yes what is it
and how it can trigger. Is an invalid op_flag ever passed?
If it's just a coverity false positive it might be ok to
work around that but document this.


> ---
>  sound/virtio/virtio_kctl.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/sound/virtio/virtio_kctl.c b/sound/virtio/virtio_kctl.c
> index 0c6ac74aca1e..d7a160c5db03 100644
> --- a/sound/virtio/virtio_kctl.c
> +++ b/sound/virtio/virtio_kctl.c
> @@ -286,6 +286,11 @@ static int virtsnd_kctl_tlv_op(struct snd_kcontrol *kcontrol, int op_flag,
>               else
>                       rc = virtsnd_ctl_msg_send(snd, msg, &sg, NULL, false);
>
> +             break;
> +     default:
> +             virtsnd_ctl_msg_unref(msg);
> +             rc = -EINVAL;
> +

There's already virtsnd_ctl_msg_unref call above.
Also don't we need virtsnd_ctl_msg_unref on other error paths
such as EFAULT?
Unify error handling to fix it all then?

>               break;
>       }
>
> --
> 2.43.0