1. Patchew
  2. QEMU
  3. View series

[Qemu-devel] [PATCH v2] xilinx_spips: Correct usage of an uninitialized local variable

Francisco Iglesias posted 1 patch 7 years, 9 months ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20180117213458.17560-1-frasse.iglesias@gmail.com
Test checkpatch passed
Test docker-build@min-glib passed
Test docker-mingw@fedora passed
Test docker-quick@centos6 passed
Test ppc passed
Test s390x passed
There is a newer version of this series
hw/ssi/xilinx_spips.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
[Qemu-devel] [PATCH v2] xilinx_spips: Correct usage of an uninitialized local variable
Posted by Francisco Iglesias 7 years, 9 months ago 
Coverity found that the variable tx_rx in the function
xilinx_spips_flush_txfifo was being used uninitialized (CID 1383841). This
patch corrects this by always initializing tx_rx to zeros.

Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com>

---
v2. Add a sanity check on the num_busses property when realizing the
    devices.
---
 hw/ssi/xilinx_spips.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index 85c5d0c..12f1de9 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -210,6 +210,9 @@
 #define SNOOP_NONE 0xEE
 #define SNOOP_STRIPING 0
 
+#define MIN_NUM_BUSSES 1
+#define MAX_NUM_BUSSES 2
+
 static inline int num_effective_busses(XilinxSPIPS *s)
 {
     return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
@@ -573,7 +576,7 @@ static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
     for (;;) {
         int i;
         uint8_t tx = 0;
-        uint8_t tx_rx[num_effective_busses(s)];
+        uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
         uint8_t dummy_cycles = 0;
         uint8_t addr_length;
 
@@ -1221,6 +1224,14 @@ static void xilinx_spips_realize(DeviceState *dev, Error **errp)
 
     DB_PRINT_L(0, "realized spips\n");
 
+    if (s->num_busses < MIN_NUM_BUSSES || s->num_busses > MAX_NUM_BUSSES) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Invalid number of spi busses requested, "
+                      "will default to use one bus\n",
+                      __func__);
+        s->num_busses = 1;
+    }
+
     s->spi = g_new(SSIBus *, s->num_busses);
     for (i = 0; i < s->num_busses; ++i) {
         char bus_name[16];
-- 
2.9.3
Re: [Qemu-devel] [PATCH v2] xilinx_spips: Correct usage of an uninitialized local variable
Posted by Peter Maydell 7 years, 9 months ago 
On 17 January 2018 at 21:34, Francisco Iglesias
<frasse.iglesias@gmail.com> wrote:
> Coverity found that the variable tx_rx in the function
> xilinx_spips_flush_txfifo was being used uninitialized (CID 1383841). This
> patch corrects this by always initializing tx_rx to zeros.
>
> Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com>
>
> ---
> v2. Add a sanity check on the num_busses property when realizing the
>     devices.
> ---
>  hw/ssi/xilinx_spips.c | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
>
> diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
> index 85c5d0c..12f1de9 100644
> --- a/hw/ssi/xilinx_spips.c
> +++ b/hw/ssi/xilinx_spips.c
> @@ -210,6 +210,9 @@
>  #define SNOOP_NONE 0xEE
>  #define SNOOP_STRIPING 0
>
> +#define MIN_NUM_BUSSES 1
> +#define MAX_NUM_BUSSES 2
> +
>  static inline int num_effective_busses(XilinxSPIPS *s)
>  {
>      return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
> @@ -573,7 +576,7 @@ static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
>      for (;;) {
>          int i;
>          uint8_t tx = 0;
> -        uint8_t tx_rx[num_effective_busses(s)];
> +        uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
>          uint8_t dummy_cycles = 0;
>          uint8_t addr_length;
>
> @@ -1221,6 +1224,14 @@ static void xilinx_spips_realize(DeviceState *dev, Error **errp)
>
>      DB_PRINT_L(0, "realized spips\n");
>
> +    if (s->num_busses < MIN_NUM_BUSSES || s->num_busses > MAX_NUM_BUSSES) {
> +        qemu_log_mask(LOG_GUEST_ERROR,
> +                      "%s: Invalid number of spi busses requested, "
> +                      "will default to use one bus\n",
> +                      __func__);
> +        s->num_busses = 1;

Realize functions should report errors in their parameters via the Error**
parameter (which will cause the realize operation to fail, which the caller
can deal with appropriately). Here's an example from the realize function
for the GICv3:

    if (s->num_irq > GICV3_MAXIRQ) {
        error_setg(errp,
                   "requested %u interrupt lines exceeds GIC maximum %d",
                   s->num_irq, GICV3_MAXIRQ);
        return;
    }

(Note no trailing \n required for error_setg strings, unlike qemu_log_mask.)

thanks
-- PMM
Re: [Qemu-devel] [PATCH v2] xilinx_spips: Correct usage of an uninitialized local variable
Posted by francisco iglesias 7 years, 9 months ago 
On Monday, 22 January 2018, Peter Maydell <peter.maydell@linaro.org> wrote:

> On 17 January 2018 at 21:34, Francisco Iglesias
> <frasse.iglesias@gmail.com> wrote:
> > Coverity found that the variable tx_rx in the function
> > xilinx_spips_flush_txfifo was being used uninitialized (CID 1383841).
> This
> > patch corrects this by always initializing tx_rx to zeros.
> >
> > Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com>
> >
> > ---
> > v2. Add a sanity check on the num_busses property when realizing the
> >     devices.
> > ---
> >  hw/ssi/xilinx_spips.c | 13 ++++++++++++-
> >  1 file changed, 12 insertions(+), 1 deletion(-)
> >
> > diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
> > index 85c5d0c..12f1de9 100644
> > --- a/hw/ssi/xilinx_spips.c
> > +++ b/hw/ssi/xilinx_spips.c
> > @@ -210,6 +210,9 @@
> >  #define SNOOP_NONE 0xEE
> >  #define SNOOP_STRIPING 0
> >
> > +#define MIN_NUM_BUSSES 1
> > +#define MAX_NUM_BUSSES 2
> > +
> >  static inline int num_effective_busses(XilinxSPIPS *s)
> >  {
> >      return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
> > @@ -573,7 +576,7 @@ static void xilinx_spips_flush_txfifo(XilinxSPIPS
> *s)
> >      for (;;) {
> >          int i;
> >          uint8_t tx = 0;
> > -        uint8_t tx_rx[num_effective_busses(s)];
> > +        uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
> >          uint8_t dummy_cycles = 0;
> >          uint8_t addr_length;
> >
> > @@ -1221,6 +1224,14 @@ static void xilinx_spips_realize(DeviceState
> *dev, Error **errp)
> >
> >      DB_PRINT_L(0, "realized spips\n");
> >
> > +    if (s->num_busses < MIN_NUM_BUSSES || s->num_busses >
> MAX_NUM_BUSSES) {
> > +        qemu_log_mask(LOG_GUEST_ERROR,
> > +                      "%s: Invalid number of spi busses requested, "
> > +                      "will default to use one bus\n",
> > +                      __func__);
> > +        s->num_busses = 1;
>
> Realize functions should report errors in their parameters via the Error**
> parameter (which will cause the realize operation to fail, which the caller
> can deal with appropriately). Here's an example from the realize function
> for the GICv3:
>
>     if (s->num_irq > GICV3_MAXIRQ) {
>         error_setg(errp,
>                    "requested %u interrupt lines exceeds GIC maximum %d",
>                    s->num_irq, GICV3_MAXIRQ);
>         return;
>     }
>
> (Note no trailing \n required for error_setg strings, unlike
> qemu_log_mask.)
>
> thanks
> -- PMM
>


Hi Peter,

Thank you very much for reviewing the patch again! I'll correct this in the
next version (3) of the patch.

Best regards,
Francisco Iglesias

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.