| Message ID | 1455179579-3476-1-git-send-email-write.harmandeep@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, 2016-02-11 at 14:02 +0530, Harmandeep Kaur wrote: > Avoid leaking the memory mapping of the trace buffer > > Coverity ID 1351228 > > Signed-off-by: Harmandeep Kaur <write.harmandeep@gmail.com> > Reviewed-by: Dario Faggioli <dario.faggioli@citrix.com> Thanks and Regards, Dario
Copying George since he maintains xentrace which this relates to. On Thu, 2016-02-11 at 14:02 +0530, Harmandeep Kaur wrote: > Avoid leaking the memory mapping of the trace buffer > > Coverity ID 1351228 > > Signed-off-by: Harmandeep Kaur <write.harmandeep@gmail.com> > --- > v2: call to unmapping function reduced to one from two > --- > tools/libxc/xc_tbuf.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/tools/libxc/xc_tbuf.c b/tools/libxc/xc_tbuf.c > index 695939a..d96cc67 100644 > --- a/tools/libxc/xc_tbuf.c > +++ b/tools/libxc/xc_tbuf.c > @@ -70,11 +70,13 @@ int xc_tbuf_get_size(xc_interface *xch, unsigned long > *size) > sysctl.u.tbuf_op.buffer_mfn); > > if ( t_info == NULL || t_info->tbuf_size == 0 ) > - return -1; > + rc = -1; > + else > + *size = t_info->tbuf_size; > > - *size = t_info->tbuf_size; > + xenforeignmemory_unmap(xch->fmem, t_info, *size); *size could be uninitialised here (in the error path) and even in the success case I don't think t_info->tbus_size is the right argument here, it needs to be the size which was passed to the map function, i.e. sysctl.u.tbuf_op.size. Ian. > > - return 0; > + return rc; > } > > int xc_tbuf_enable(xc_interface *xch, unsigned long pages, unsigned long > *mfn,
On Thu, 2016-02-11 at 09:52 +0000, Ian Campbell wrote: > On Thu, 2016-02-11 at 14:02 +0530, Harmandeep Kaur wrote: > > > > diff --git a/tools/libxc/xc_tbuf.c b/tools/libxc/xc_tbuf.c > > index 695939a..d96cc67 100644 > > --- a/tools/libxc/xc_tbuf.c > > +++ b/tools/libxc/xc_tbuf.c > > @@ -70,11 +70,13 @@ int xc_tbuf_get_size(xc_interface *xch, > > unsigned long > > *size) > > sysctl.u.tbuf_op.buffer_mfn); > > > > if ( t_info == NULL || t_info->tbuf_size == 0 ) > > - return -1; > > + rc = -1; > > + else > > + *size = t_info->tbuf_size; > > > > - *size = t_info->tbuf_size; > > + xenforeignmemory_unmap(xch->fmem, t_info, *size); > > *size could be uninitialised here (in the error path) and even in the > success case I don't think t_info->tbus_size is the right argument > here, it > needs to be the size which was passed to the map function, i.e. > sysctl.u.tbuf_op.size. > And I think both are issues with the current code, and, more important, not what Coverity is complaining about in the referenced CID? To be clear, I'm not arguing that they're not issues we should fix (I don't know about the tbuf_size vs. tbuf_op.size, but I can check). I'm genuinely asking whether we should do that here, as compared to in a pre or follow up patch, and let this one be the one that placates Coverity on that particular issue. Regards, Dario
On Thu, 2016-02-11 at 11:03 +0100, Dario Faggioli wrote: > On Thu, 2016-02-11 at 09:52 +0000, Ian Campbell wrote: > > On Thu, 2016-02-11 at 14:02 +0530, Harmandeep Kaur wrote: > > > > > > diff --git a/tools/libxc/xc_tbuf.c b/tools/libxc/xc_tbuf.c > > > index 695939a..d96cc67 100644 > > > --- a/tools/libxc/xc_tbuf.c > > > +++ b/tools/libxc/xc_tbuf.c > > > @@ -70,11 +70,13 @@ int xc_tbuf_get_size(xc_interface *xch, > > > unsigned long > > > *size) > > > sysctl.u.tbuf_op.buffer_mfn); > > > > > > if ( t_info == NULL || t_info->tbuf_size == 0 ) > > > - return -1; > > > + rc = -1; > > > + else > > > + *size = t_info->tbuf_size; > > > > > > - *size = t_info->tbuf_size; > > > + xenforeignmemory_unmap(xch->fmem, t_info, *size); > > > > *size could be uninitialised here (in the error path) and even in the > > success case I don't think t_info->tbus_size is the right argument > > here, it > > needs to be the size which was passed to the map function, i.e. > > sysctl.u.tbuf_op.size. > > > And I think both are issues with the current code, I don't think so, the xenforeignmemory_unmap using *size as an argument (where it is either uninitialised or the wrong value) is added by this patch. > and, more important, > not what Coverity is complaining about in the referenced CID? > To be clear, I'm not arguing that they're not issues we should fix (I > don't know about the tbuf_size vs. tbuf_op.size, but I can check). I'm > genuinely asking whether we should do that here, as compared to in a > pre or follow up patch, and let this one be the one that placates > Coverity on that particular issue. Ian.
On Thu, 2016-02-11 at 10:11 +0000, Ian Campbell wrote: > On Thu, 2016-02-11 at 11:03 +0100, Dario Faggioli wrote: > > On Thu, 2016-02-11 at 09:52 +0000, Ian Campbell wrote: > > > On Thu, 2016-02-11 at 14:02 +0530, Harmandeep Kaur wrote: > > > > > > > > diff --git a/tools/libxc/xc_tbuf.c b/tools/libxc/xc_tbuf.c > > > > index 695939a..d96cc67 100644 > > > > --- a/tools/libxc/xc_tbuf.c > > > > +++ b/tools/libxc/xc_tbuf.c > > > > @@ -70,11 +70,13 @@ int xc_tbuf_get_size(xc_interface *xch, > > > > unsigned long > > > > *size) > > > > sysctl.u.tbuf_op.buffer_mfn); > > > > > > > > if ( t_info == NULL || t_info->tbuf_size == 0 ) > > > > - return -1; > > > > + rc = -1; > > > > + else > > > > + *size = t_info->tbuf_size; > > > > > > > > - *size = t_info->tbuf_size; > > > > + xenforeignmemory_unmap(xch->fmem, t_info, *size); > > > > > > *size could be uninitialised here (in the error path) and even in > > > the > > > success case I don't think t_info->tbus_size is the right > > > argument > > > here, it > > > needs to be the size which was passed to the map function, i.e. > > > sysctl.u.tbuf_op.size. > > > > > And I think both are issues with the current code, > > I don't think so, the xenforeignmemory_unmap using *size as an > argument > (where it is either uninitialised or the wrong value) is added by > this > patch. > Ah, that one! Yes, you're right, I had overlooked this, and thought you where referring to something else, sorry. I agree sysctl.u.tbuf_op.size is what should be used. Regards, Dario
diff --git a/tools/libxc/xc_tbuf.c b/tools/libxc/xc_tbuf.c index 695939a..d96cc67 100644 --- a/tools/libxc/xc_tbuf.c +++ b/tools/libxc/xc_tbuf.c @@ -70,11 +70,13 @@ int xc_tbuf_get_size(xc_interface *xch, unsigned long *size) sysctl.u.tbuf_op.buffer_mfn); if ( t_info == NULL || t_info->tbuf_size == 0 ) - return -1; + rc = -1; + else + *size = t_info->tbuf_size; - *size = t_info->tbuf_size; + xenforeignmemory_unmap(xch->fmem, t_info, *size); - return 0; + return rc; } int xc_tbuf_enable(xc_interface *xch, unsigned long pages, unsigned long *mfn,
Avoid leaking the memory mapping of the trace buffer Coverity ID 1351228 Signed-off-by: Harmandeep Kaur <write.harmandeep@gmail.com> --- v2: call to unmapping function reduced to one from two --- tools/libxc/xc_tbuf.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)