linuxppc / linuxppc/issues

Fix KVM coverity warnings

Open
#108 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

cleanup easy
Dominant language
No language data
Stars
14
Forks
0
PR merge metrics
No merged PRs in 30d

Description

```
*** CID 178601: Integer handling issues (BAD_SHIFT)
/arch/powerpc/include/asm/kvm_book3s_64.h: 247 in compute_tlbie_rb()
241 } else {
242 int aval_shift;
243 /*
244 * remaining bits of AVA/LP fields
245 * Also contain the rr bits of LP
246 */
>>> CID 178601: Integer handling issues (BAD_SHIFT)
>>> In expression "va_low << b_pgshift", shifting by a negative amount has undefined behavior. The shift amount, "b_pgshift", is -1.
247 rb |= (va_low << b_pgshift) & 0x7ff000;
248 /*
249 * Now clear not needed LP bits based on actual psize
250 */
251 rb &= ~((1ul << a_pgshift) - 1);
252 /*
```

```
*** CID 178619: Code maintainability issues (UNUSED_VALUE)
/arch/powerpc/kvm/book3s_64_mmu_radix.c: 576 in kvmppc_hv_get_dirty_log_radix()
570 * Since we have at most one PTE covering any given guest
571 * real address, if npages > 1 we can skip to i + npages.
572 */
573 j = i + 1;
574 if (npages) {
575 set_dirty_bits(map, i, npages);
>>> CID 178619: Code maintainability issues (UNUSED_VALUE)
>>> Assigning value from "j + npages" to "i" here, but that stored value is overwritten before it can be used.
576 i = j + npages;
577 }
578 }
579 return 0;
580 }
```

```
*** CID 178617: Integer handling issues (BAD_SHIFT)
/arch/powerpc/include/asm/kvm_book3s_64.h: 162 in kvmppc_actual_pgsz()
156 tmp >>= 8;
157 return tmp;
158 }
159
160 static inline unsigned long kvmppc_actual_pgsz(unsigned long v, unsigned long r)
161 {
>>> CID 178617: Integer handling issues (BAD_SHIFT)
>>> In expression "1UL << kvmppc_hpte_actual_page_shift(v, r)", shifting by a negative amount has undefined behavior. The shift amount, "kvmppc_hpte_actual_page_shift(v, r)", is -1.
162 return 1ul << kvmppc_hpte_actual_page_shift(v, r);
163 }
164
165 static inline int kvmppc_pgsize_lp_encoding(int base_shift, int actual_shift)
166 {
167 switch (base_shift) {
```

```
*** CID 178606: Insecure data handling (TAINTED_SCALAR)
/arch/powerpc/kvm/book3s_hv_builtin.c: 658 in wait_for_sync()
652 static void wait_for_sync(struct kvm_split_mode *sip, int phase)
653 {
654 int thr = local_paca->kvm_hstate.tid;
655
656 sip->lpcr_sync.phase[thr] |= phase;
657 phase = ALL(phase);
>>> CID 178606: Insecure data handling (TAINTED_SCALAR)
>>> Using tainted variable "phase" as a loop boundary.
658 while ((sip->lpcr_sync.allphases & phase) != phase) {
659 HMT_low();
660 barrier();
661 }
662 HMT_medium();
663 }
```

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review the four Coverity findings at compute_tlbie_rb() and kvmppc_actual_pgsz() in arch/powerpc/include/asm/kvm_book3s_64.h, kvmppc_hv_get_dirty_log_radix() in arch/powerpc/kvm/book3s_64_mmu_radix.c, and wait_for_sync() in arch/powerpc/kvm/book3s_hv_builtin.c. Start by tracing the shift, loop, and phase-handling logic around each reported line. Done means the warnings are addressed without changing intended KVM behavior and the findings are clean on a new Coverity run.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.