From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 4E69EAC0C85 for ; Fri, 10 Nov 2023 05:59:28 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=EDs+6RnSIL4tKu7ZfkOXQBEtd4sGolWvhsOO1ppLhEg=; c=relaxed/simple; d=groups.io; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject:To:Cc:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Type; s=20140610; t=1699595966; v=1; b=aP7uCsY4sEH2Ub7xgM5bD0cF6ScZclOnIFTR8r74Eb5h19i+Tckm+A02eZpzGYlCVoU0X6W4 p99hwMWUR30VJsZ41aJMmPxh3EMO5d5aBremi22Opy0G/vqII1hafg7oWRhw37WXwn4QcdJSeSH U89XpuAjcAzVVmBvX4ZHwYyY= X-Received: by 127.0.0.2 with SMTP id e9Z7YY7687511xunOWfH8Mda; Thu, 09 Nov 2023 21:59:26 -0800 X-Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by mx.groups.io with SMTP id smtpd.web10.22175.1699595966147668954 for ; Thu, 09 Nov 2023 21:59:26 -0800 X-Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-2802c41b716so1479505a91.1 for ; Thu, 09 Nov 2023 21:59:25 -0800 (PST) X-Gm-Message-State: KW5KbhaZVaOyIlynssNpnLIQx7686176AA= X-Google-Smtp-Source: AGHT+IE3+96hF5pNrpNwEbopBqJqNfRbvYldSkWjDu0oWu9kB4NJJDHczeMY3Hn0SEdO7uHh1T4Btc/Kib4u9gTSdX8= X-Received: by 2002:a17:90b:19ce:b0:280:35ce:5e0f with SMTP id nm14-20020a17090b19ce00b0028035ce5e0fmr3486854pjb.11.1699595965280; Thu, 09 Nov 2023 21:59:25 -0800 (PST) MIME-Version: 1.0 References: <20231107061959.113213-1-rsingh@ventanamicro.com> <20231107061959.113213-4-rsingh@ventanamicro.com> In-Reply-To: From: "Ranbir Singh" Date: Fri, 10 Nov 2023 11:29:14 +0530 Message-ID: Subject: Re: [edk2-devel] [PATCH v2 3/5] MdeModulePkg/Bus/Pci/PciBusDxe: Fix ARRAY_VS_SINGLETON Coverity issues To: Laszlo Ersek Cc: devel@edk2.groups.io, Ray Ni , Veeresh Sangolli Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,rsingh@ventanamicro.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: Content-Type: multipart/alternative; boundary="000000000000c5c8ad0609c60563" X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=aP7uCsY4; dmarc=none; spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io --000000000000c5c8ad0609c60563 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I was apprehensive about this from the very beginning. Anyway, for now I will be dropping this issue from the series. On Tue, Nov 7, 2023 at 10:11=E2=80=AFPM Laszlo Ersek wr= ote: > On 11/7/23 07:19, Ranbir Singh wrote: > > From: Ranbir Singh > > > > The function PciHostBridgeResourceAllocator is not making use of the > > generic approach as is used in one of the other function namely - > > DumpResourceMap. As a result, the following warnings can be seen as > > reported by Coverity e.g. > > > > (30) Event address_of: Taking address with "&IoBridge" yields a > > singleton pointer. > > (31) Event callee_ptr_arith: Passing "&IoBridge" to function > > "FindResourceNode" which uses it as an array. This might corrupt > > or misinterpret adjacent memory locations. > > > > Hence, adopt the generic approach to fix the issues at relevant points. > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4239 > > > > Cc: Ray Ni > > Co-authored-by: Veeresh Sangolli > > Signed-off-by: Ranbir Singh > > Signed-off-by: Ranbir Singh > > --- > > MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c | 37 ++++++++++++++++---- > > 1 file changed, 31 insertions(+), 6 deletions(-) > > > > diff --git a/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c > b/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c > > index 84fc0161a19c..71767d3793d4 100644 > > --- a/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c > > +++ b/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c > > @@ -485,6 +485,8 @@ PciHostBridgeResourceAllocator ( > > UINT64 Mem64ResStatus; > > UINT64 PMem64ResStatus; > > UINT32 MaxOptionRomSize; > > + PCI_RESOURCE_NODE **ChildResources; > > + UINTN ChildResourceCount; > > PCI_RESOURCE_NODE *IoBridge; > > PCI_RESOURCE_NODE *Mem32Bridge; > > PCI_RESOURCE_NODE *PMem32Bridge; > > @@ -895,16 +897,39 @@ PciHostBridgeResourceAllocator ( > > // Create the entire system resource map from the information > collected by > > // enumerator. Several resource tree was created > > // > > - FindResourceNode (RootBridgeDev, &IoPool, &IoBridge); > > - FindResourceNode (RootBridgeDev, &Mem32Pool, &Mem32Bridge); > > - FindResourceNode (RootBridgeDev, &PMem32Pool, &PMem32Bridge); > > - FindResourceNode (RootBridgeDev, &Mem64Pool, &Mem64Bridge); > > - FindResourceNode (RootBridgeDev, &PMem64Pool, &PMem64Bridge); > > - > > + ChildResourceCount =3D FindResourceNode (RootBridgeDev, &IoPool, > NULL); > > + ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_NODE *) * > ChildResourceCount); > > + ASSERT (ChildResources !=3D NULL); > > + FindResourceNode (RootBridgeDev, &IoPool, &ChildResources[0]); > > + IoBridge =3D ChildResources[0]; > > ASSERT (IoBridge !=3D NULL); > > + > > + ChildResourceCount =3D FindResourceNode (RootBridgeDev, &Mem32Pool= , > NULL); > > + ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_NODE *) * > ChildResourceCount); > > + ASSERT (ChildResources !=3D NULL); > > + FindResourceNode (RootBridgeDev, &Mem32Pool, &ChildResources[0]); > > + Mem32Bridge =3D ChildResources[0]; > > ASSERT (Mem32Bridge !=3D NULL); > > + > > + ChildResourceCount =3D FindResourceNode (RootBridgeDev, &PMem32Poo= l, > NULL); > > + ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_NODE *) * > ChildResourceCount); > > + ASSERT (ChildResources !=3D NULL); > > + FindResourceNode (RootBridgeDev, &PMem32Pool, &ChildResources[0]); > > + PMem32Bridge =3D ChildResources[0]; > > ASSERT (PMem32Bridge !=3D NULL); > > + > > + ChildResourceCount =3D FindResourceNode (RootBridgeDev, &Mem64Pool= , > NULL); > > + ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_NODE *) * > ChildResourceCount); > > + ASSERT (ChildResources !=3D NULL); > > + FindResourceNode (RootBridgeDev, &Mem64Pool, &ChildResources[0]); > > + Mem64Bridge =3D ChildResources[0]; > > ASSERT (Mem64Bridge !=3D NULL); > > + > > + ChildResourceCount =3D FindResourceNode (RootBridgeDev, &PMem64Poo= l, > NULL); > > + ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_NODE *) * > ChildResourceCount); > > + ASSERT (ChildResources !=3D NULL); > > + FindResourceNode (RootBridgeDev, &PMem64Pool, &ChildResources[0]); > > + PMem64Bridge =3D ChildResources[0]; > > ASSERT (PMem64Bridge !=3D NULL); > > > > // > > Sorry, but this is terrible. > > * First of all, Coverity is *wrong*. The C spec clearly states that, for > the purposes of pointer arithmetic, a singleton object behaves > identically to the first element of an array. > > So, immediately, the idea arises that we should just use > > PCI_RESOURCE_NODE *IoBridgeArray[1]; > > FindResourceNode (RootBridgeDev, &IoPool, IoBridgeArray) > > to shut up Coverity. > > * Unfortunately, I expect that would only create a different warning: a > warning about potentially overflowing this single-element array. Which > is in fact a deeper problem in FindResourceNode() -- it happily > overwrites an array that is too small. > > * Finally, this generic approach is both ugly (lots of code > duplication!), and worse, it allocates memory without proper error > checking (ASSERT() is not error checking), and then it leaks > ChildResources *multiple times*! > > I suggest the following, for solving all of these issues: > > - create a function called FindFirstResourceNode(). It should have the > same function prototype as FindResourceNode(), except the last parameter > should be mandatory, not OPTIONAL. > > - the internal logic should be the same, except we shouldn't be > counting, the return value should be a BOOLEAN. If we find a match, then > output the first match and return TRUE. Otherwise, set the output to > NULL and return FALSE. > > - replace the FindResourceNode calls with FindFirstResourceNode calls > > - Those call sites are already followed by ASSERT()s, saying that all > search attempts will succeed. If coverity is happy with them, that's > good; otherwise, we'll have to find a solution for them as well. > > Laszlo > > -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#111016): https://edk2.groups.io/g/devel/message/111016 Mute This Topic: https://groups.io/mt/102438300/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- --000000000000c5c8ad0609c60563 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I was apprehensive about this from the very beginning.
Anyway, for now I will be dropping this issue from the seri= es.

On Tue, Nov 7, 2023 at 10:11=E2=80=AFPM Laszlo Ersek <lersek@redhat.com> wrote:
On 11/7/23 07:19, Ranbir Sin= gh wrote:
> From: Ranbir Singh <Ranbir.Singh3@Dell.com>
>
> The function PciHostBridgeResourceAllocator is not making use of the > generic approach as is used in one of the other function namely -
> DumpResourceMap. As a result, the following warnings can be seen as > reported by Coverity e.g.
>
> (30) Event address_of:=C2=A0 =C2=A0 =C2=A0 =C2=A0 Taking address with = "&IoBridge" yields a
>=C2=A0 =C2=A0 =C2=A0 singleton pointer.
> (31) Event callee_ptr_arith:=C2=A0 Passing "&IoBridge" t= o function
>=C2=A0 =C2=A0 =C2=A0 "FindResourceNode" which uses it as an a= rray. This might corrupt
>=C2=A0 =C2=A0 =C2=A0 or misinterpret adjacent memory locations.
>
> Hence, adopt the generic approach to fix the issues at relevant points= .
>
> REF: https://bugzilla.tianocore.org/show_b= ug.cgi?id=3D4239
>
> Cc: Ray Ni <r= ay.ni@intel.com>
> Co-authored-by: Veeresh Sangolli <veeresh.sangolli@dellteam.com>
> Signed-off-by: Ranbir Singh <Ranbir.Singh3@Dell.com>
> Signed-off-by: Ranbir Singh <rsingh@ventanamicro.com>
> ---
>=C2=A0 MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c | 37 ++++++++++++++++---= -
>=C2=A0 1 file changed, 31 insertions(+), 6 deletions(-)
>
> diff --git a/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c b/MdeModulePkg/Bu= s/Pci/PciBusDxe/PciLib.c
> index 84fc0161a19c..71767d3793d4 100644
> --- a/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c
> +++ b/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c
> @@ -485,6 +485,8 @@ PciHostBridgeResourceAllocator (
>=C2=A0 =C2=A0 UINT64=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0Mem64ResStatus;
>=C2=A0 =C2=A0 UINT64=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0PMem64ResStatus;
>=C2=A0 =C2=A0 UINT32=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0MaxOptionRomSize;
> +=C2=A0 PCI_RESOURCE_NODE=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 **ChildResource= s;
> +=C2=A0 UINTN=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 ChildResourceCount;
>=C2=A0 =C2=A0 PCI_RESOURCE_NODE=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 *IoBridg= e;
>=C2=A0 =C2=A0 PCI_RESOURCE_NODE=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 *Mem32Br= idge;
>=C2=A0 =C2=A0 PCI_RESOURCE_NODE=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 *PMem32B= ridge;
> @@ -895,16 +897,39 @@ PciHostBridgeResourceAllocator (
>=C2=A0 =C2=A0 =C2=A0 // Create the entire system resource map from the = information collected by
>=C2=A0 =C2=A0 =C2=A0 // enumerator. Several resource tree was created >=C2=A0 =C2=A0 =C2=A0 //
> -=C2=A0 =C2=A0 FindResourceNode (RootBridgeDev, &IoPool, &IoBr= idge);
> -=C2=A0 =C2=A0 FindResourceNode (RootBridgeDev, &Mem32Pool, &M= em32Bridge);
> -=C2=A0 =C2=A0 FindResourceNode (RootBridgeDev, &PMem32Pool, &= PMem32Bridge);
> -=C2=A0 =C2=A0 FindResourceNode (RootBridgeDev, &Mem64Pool, &M= em64Bridge);
> -=C2=A0 =C2=A0 FindResourceNode (RootBridgeDev, &PMem64Pool, &= PMem64Bridge);
> -
> +=C2=A0 =C2=A0 ChildResourceCount =3D FindResourceNode (RootBridgeDev,= &IoPool, NULL);
> +=C2=A0 =C2=A0 ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_N= ODE *) * ChildResourceCount);
> +=C2=A0 =C2=A0 ASSERT (ChildResources !=3D NULL);
> +=C2=A0 =C2=A0 FindResourceNode (RootBridgeDev, &IoPool, &Chil= dResources[0]);
> +=C2=A0 =C2=A0 IoBridge =3D ChildResources[0];
>=C2=A0 =C2=A0 =C2=A0 ASSERT (IoBridge=C2=A0 =C2=A0 =C2=A0!=3D NULL); > +
> +=C2=A0 =C2=A0 ChildResourceCount =3D FindResourceNode (RootBridgeDev,= &Mem32Pool, NULL);
> +=C2=A0 =C2=A0 ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_N= ODE *) * ChildResourceCount);
> +=C2=A0 =C2=A0 ASSERT (ChildResources !=3D NULL);
> +=C2=A0 =C2=A0 FindResourceNode (RootBridgeDev, &Mem32Pool, &C= hildResources[0]);
> +=C2=A0 =C2=A0 Mem32Bridge =3D ChildResources[0];
>=C2=A0 =C2=A0 =C2=A0 ASSERT (Mem32Bridge=C2=A0 !=3D NULL);
> +
> +=C2=A0 =C2=A0 ChildResourceCount =3D FindResourceNode (RootBridgeDev,= &PMem32Pool, NULL);
> +=C2=A0 =C2=A0 ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_N= ODE *) * ChildResourceCount);
> +=C2=A0 =C2=A0 ASSERT (ChildResources !=3D NULL);
> +=C2=A0 =C2=A0 FindResourceNode (RootBridgeDev, &PMem32Pool, &= ChildResources[0]);
> +=C2=A0 =C2=A0 PMem32Bridge =3D ChildResources[0];
>=C2=A0 =C2=A0 =C2=A0 ASSERT (PMem32Bridge !=3D NULL);
> +
> +=C2=A0 =C2=A0 ChildResourceCount =3D FindResourceNode (RootBridgeDev,= &Mem64Pool, NULL);
> +=C2=A0 =C2=A0 ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_N= ODE *) * ChildResourceCount);
> +=C2=A0 =C2=A0 ASSERT (ChildResources !=3D NULL);
> +=C2=A0 =C2=A0 FindResourceNode (RootBridgeDev, &Mem64Pool, &C= hildResources[0]);
> +=C2=A0 =C2=A0 Mem64Bridge =3D ChildResources[0];
>=C2=A0 =C2=A0 =C2=A0 ASSERT (Mem64Bridge=C2=A0 !=3D NULL);
> +
> +=C2=A0 =C2=A0 ChildResourceCount =3D FindResourceNode (RootBridgeDev,= &PMem64Pool, NULL);
> +=C2=A0 =C2=A0 ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_N= ODE *) * ChildResourceCount);
> +=C2=A0 =C2=A0 ASSERT (ChildResources !=3D NULL);
> +=C2=A0 =C2=A0 FindResourceNode (RootBridgeDev, &PMem64Pool, &= ChildResources[0]);
> +=C2=A0 =C2=A0 PMem64Bridge =3D ChildResources[0];
>=C2=A0 =C2=A0 =C2=A0 ASSERT (PMem64Bridge !=3D NULL);
>=C2=A0
>=C2=A0 =C2=A0 =C2=A0 //

Sorry, but this is terrible.

* First of all, Coverity is *wrong*. The C spec clearly states that, for the purposes of pointer arithmetic, a singleton object behaves
identically to the first element of an array.

So, immediately, the idea arises that we should just use

=C2=A0 PCI_RESOURCE_NODE *IoBridgeArray[1];

=C2=A0 FindResourceNode (RootBridgeDev, &IoPool, IoBridgeArray)

to shut up Coverity.

* Unfortunately, I expect that would only create a different warning: a
warning about potentially overflowing this single-element array. Which
is in fact a deeper problem in FindResourceNode() -- it happily
overwrites an array that is too small.

* Finally, this generic approach is both ugly (lots of code
duplication!), and worse, it allocates memory without proper error
checking (ASSERT() is not error checking), and then it leaks
ChildResources *multiple times*!

I suggest the following, for solving all of these issues:

- create a function called FindFirstResourceNode(). It should have the
same function prototype as FindResourceNode(), except the last parameter should be mandatory, not OPTIONAL.

- the internal logic should be the same, except we shouldn't be
counting, the return value should be a BOOLEAN. If we find a match, then output the first match and return TRUE. Otherwise, set the output to
NULL and return FALSE.

- replace the FindResourceNode calls with FindFirstResourceNode calls

- Those call sites are already followed by ASSERT()s, saying that all
search attempts will succeed. If coverity is happy with them, that's good; otherwise, we'll have to find a solution for them as well.

Laszlo

_._,_._,_
Groups.io Links:

=20 You receive all messages sent to this group. =20 =20

View/Reply Online (#111016) | =20 | Mute= This Topic | New Topic
Your Subscriptio= n | Contact Group Owner | Unsubscribe [rebecca@openfw.io]

_._,_._,_
--000000000000c5c8ad0609c60563--