linux-kernel - Re: [BUG] 6.10 stable: arch/x86/kvm/xen.c:1486:44: error: use of uninitialized value ‘port’ [CWE-457]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <34df3c7d-9f39-4878-80a9-72f5d2d858db@gmail.com>
Date: Fri, 19 Jul 2024 21:53:45 +0200
From: Mirsad Todorovac <mtodorovac69@...il.com>
To: Sean Christopherson <seanjc@...gle.com>
Cc: kvm@...r.kernel.org, Paolo Bonzini <pbonzini@...hat.com>,
 Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
 Borislav Petkov <bp@...en8.de>, Dave Hansen <dave.hansen@...ux.intel.com>,
 x86@...nel.org, "H. Peter Anvin" <hpa@...or.com>,
 linux-kernel@...r.kernel.org, Boris Ostrovsky <boris.ostrovsky@...cle.com>
Subject: Re: [BUG] 6.10 stable: arch/x86/kvm/xen.c:1486:44: error: use of uninitialized value ‘port’ [CWE-457]

On 7/19/24 19:30, Sean Christopherson wrote:
> On Fri, Jul 19, 2024, Mirsad Todorovac wrote:
>> Hi, all,
>>
>> While building stable tree version of 6.10, the following error occurred:
>>
>> In line 1421 defines:
>>
>> 1421        evtchn_port_t port, *ports;
>>
>> The ports becomes &port in line 1470, but neither port nor *ports is assigned a value
>> until line 1486 where port is used:
>>
>> 1485         if (sched_poll.nr_ports == 1)
>> 1486 →               vcpu->arch.xen.poll_evtchn = port;
>>
>> The visual inspection proves that the compiler is again right (GCC 12.3.0).
> 
> Nope, the compiler is wrong.  If sched_poll.nr_ports > 0, then kvm_read_guest_virt()
> will fill ports[sched_poll.nr_ports].  If kvm_read_guest_virt() fails to do so,
> it will return an error and the above code will never be reached.
> 
> 	if (kvm_read_guest_virt(vcpu, (gva_t)sched_poll.ports, ports,
> 				sched_poll.nr_ports * sizeof(*ports), &e)) {
> 		*r = -EFAULT;
> 		return true;
> 	}

Hi again,

I see what you mean.

Apparently, this dependency is not visible by the compiler, and this makes static analysers of
dubious value ...

I might need some advice on how to contribute to the Q/A of the kernel proper and testing suite
...

Best regards,
Mirsad Todorovac