[v1] fix bugs reported by Clang Static Analyzer

[Qemu-devel] [PATCH for 2.10 04/35] ivshmem: fix incorrect error handling in ivshmem_recv_msg()

Posted by Philippe Mathieu-Daudé 8 years, 3 months ago

If qemu_chr_fe_read_all() returns -EINTR the do {} statement continues and the
n accumulator used to complete reads upto sizeof(msg) is decremented by 4 (the
value of EINTR on Linux).
To avoid that, use simpler if() statements and continue if EINTR occured.

hw/misc/ivshmem.c:650:14: warning: Loss of sign in implicit conversion
    } while (n < sizeof(msg));
             ^

Reported-by: Clang Static Analyzer
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
get_maintainer.pl: No maintainers found!

 hw/misc/ivshmem.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index a58f9ee579..47a015f072 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -642,7 +642,10 @@ static int64_t ivshmem_recv_msg(IVShmemState *s, int *pfd, Error **errp)
     do {
         ret = qemu_chr_fe_read_all(&s->server_chr, (uint8_t *)&msg + n,
                                    sizeof(msg) - n);
-        if (ret < 0 && ret != -EINTR) {
+        if (ret < 0) {
+            if (ret == -EINTR) {
+                continue;
+            }
             error_setg_errno(errp, -ret, "read from server failed");
             return INT64_MIN;
         }
-- 
2.13.3

Re: [Qemu-devel] [PATCH for 2.10 04/35] ivshmem: fix incorrect error handling in ivshmem_recv_msg()

Posted by Markus Armbruster 8 years, 3 months ago

Philippe Mathieu-Daudé <f4bug@amsat.org> writes:

> If qemu_chr_fe_read_all() returns -EINTR the do {} statement continues and the
> n accumulator used to complete reads upto sizeof(msg) is decremented by 4 (the
> value of EINTR on Linux).
> To avoid that, use simpler if() statements and continue if EINTR occured.
>
> hw/misc/ivshmem.c:650:14: warning: Loss of sign in implicit conversion
>     } while (n < sizeof(msg));
>              ^
>

Let's add "Screwed up in commit 3a55fc0f, v2.6.0."

> Reported-by: Clang Static Analyzer
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
> get_maintainer.pl: No maintainers found!
>
>  hw/misc/ivshmem.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
> index a58f9ee579..47a015f072 100644
> --- a/hw/misc/ivshmem.c
> +++ b/hw/misc/ivshmem.c
> @@ -642,7 +642,10 @@ static int64_t ivshmem_recv_msg(IVShmemState *s, int *pfd, Error **errp)
>      do {
>          ret = qemu_chr_fe_read_all(&s->server_chr, (uint8_t *)&msg + n,
>                                     sizeof(msg) - n);
> -        if (ret < 0 && ret != -EINTR) {
> +        if (ret < 0) {
> +            if (ret == -EINTR) {
> +                continue;
> +            }
>              error_setg_errno(errp, -ret, "read from server failed");
>              return INT64_MIN;
>          }

Reviewed-by: Markus Armbruster <armbru@redhat.com>

Paolo, you taking this through your miscellaneous queue would save me
(and possibly Peter) a bit of work.  Only if you have something queued
already.  Let me know.

Re: [Qemu-devel] [PATCH for 2.10 04/35] ivshmem: fix incorrect error handling in ivshmem_recv_msg()

Posted by Paolo Bonzini 8 years, 3 months ago

On 25/07/2017 10:18, Markus Armbruster wrote:
> Philippe Mathieu-Daudé <f4bug@amsat.org> writes:
> 
>> If qemu_chr_fe_read_all() returns -EINTR the do {} statement continues and the
>> n accumulator used to complete reads upto sizeof(msg) is decremented by 4 (the
>> value of EINTR on Linux).
>> To avoid that, use simpler if() statements and continue if EINTR occured.
>>
>> hw/misc/ivshmem.c:650:14: warning: Loss of sign in implicit conversion
>>     } while (n < sizeof(msg));
>>              ^
>>
> 
> Let's add "Screwed up in commit 3a55fc0f, v2.6.0."
> 
>> Reported-by: Clang Static Analyzer
>> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
>> ---
>> get_maintainer.pl: No maintainers found!
>>
>>  hw/misc/ivshmem.c | 5 ++++-
>>  1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
>> index a58f9ee579..47a015f072 100644
>> --- a/hw/misc/ivshmem.c
>> +++ b/hw/misc/ivshmem.c
>> @@ -642,7 +642,10 @@ static int64_t ivshmem_recv_msg(IVShmemState *s, int *pfd, Error **errp)
>>      do {
>>          ret = qemu_chr_fe_read_all(&s->server_chr, (uint8_t *)&msg + n,
>>                                     sizeof(msg) - n);
>> -        if (ret < 0 && ret != -EINTR) {
>> +        if (ret < 0) {
>> +            if (ret == -EINTR) {
>> +                continue;
>> +            }
>>              error_setg_errno(errp, -ret, "read from server failed");
>>              return INT64_MIN;
>>          }
> 
> Reviewed-by: Markus Armbruster <armbru@redhat.com>
> 
> Paolo, you taking this through your miscellaneous queue would save me
> (and possibly Peter) a bit of work.  Only if you have something queued
> already.  Let me know.

Fair enough, I'll pick this up.

Paolo