From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id F017F9418BC for ; Tue, 7 Nov 2023 16:04:18 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=hlVNfrz6TVewnoRtWf2jlB+tcarXV5Wv1KpjGTNyOwE=; c=relaxed/simple; d=groups.io; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From:In-Reply-To:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Language:Content-Type:Content-Transfer-Encoding; s=20140610; t=1699373057; v=1; b=PZ+GIW7DiwXuoInAK64f8IZDp13D0ttiL13eeENF+coglcS2SPQ0I2AfRWjY0eJ17DJ2nkc8 /5s4t1i/8KOJmAL0KwtEO7fu/TEzxWct3bejb3hPvmY0+z0R0MlYdls4pVR9PVhzqZRAiJk99hl vPxiVYAIpVowJqPmsl/o3OFo= X-Received: by 127.0.0.2 with SMTP id YRn0YY7687511xsevlOkxe11; Tue, 07 Nov 2023 08:04:17 -0800 X-Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.groups.io with SMTP id smtpd.web10.14798.1699373056852579633 for ; Tue, 07 Nov 2023 08:04:17 -0800 X-Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-17-iyrHnQ7pPh-a6FQwg0HJRA-1; Tue, 07 Nov 2023 11:04:13 -0500 X-MC-Unique: iyrHnQ7pPh-a6FQwg0HJRA-1 X-Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 4C4173816B47; Tue, 7 Nov 2023 16:04:12 +0000 (UTC) X-Received: from [10.39.193.64] (unknown [10.39.193.64]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 89F50492BE7; Tue, 7 Nov 2023 16:04:11 +0000 (UTC) Message-ID: Date: Tue, 7 Nov 2023 17:04:10 +0100 MIME-Version: 1.0 Subject: Re: [edk2-devel] [PATCH v2 1/2] MdeModulePkg/Bus/Pci/XhciDxe: Fix FORWARD_NULL Coverity issues To: devel@edk2.groups.io, rsingh@ventanamicro.com Cc: Ray Ni , Veeresh Sangolli References: <20231107055800.86752-1-rsingh@ventanamicro.com> <20231107055800.86752-2-rsingh@ventanamicro.com> From: "Laszlo Ersek" In-Reply-To: <20231107055800.86752-2-rsingh@ventanamicro.com> X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,lersek@redhat.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: Ny45qy1R7JdD9CqgoJkvjODNx7686176AA= Content-Language: en-US Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=PZ+GIW7D; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=redhat.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io On 11/7/23 06:57, Ranbir Singh wrote: > From: Ranbir Singh >=20 > The functions UsbHcGetHostAddrForPciAddr, UsbHcGetPciAddrForHostAddr > and UsbHcFreeMem do have >=20 > ASSERT ((Block !=3D NULL)); >=20 > statements after for loop, but these are applicable only in DEBUG mode. > In RELEASE mode, if for whatever reasons there is no match inside for > loop and the loop exits because of Block !=3D NULL; condition, then there > is no "Block" NULL pointer check afterwards and the code proceeds to do > dereferencing "Block" which will lead to CRASH. >=20 > Hence, for safety add NULL pointer checks always. >=20 > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4221 >=20 > Cc: Ray Ni > Co-authored-by: Veeresh Sangolli > Signed-off-by: Ranbir Singh > Signed-off-by: Ranbir Singh > --- > MdeModulePkg/Bus/Pci/XhciDxe/UsbHcMem.c | 14 ++++++++++++++ > 1 file changed, 14 insertions(+) >=20 > diff --git a/MdeModulePkg/Bus/Pci/XhciDxe/UsbHcMem.c b/MdeModulePkg/Bus/P= ci/XhciDxe/UsbHcMem.c > index b54187ec228e..b0654f148c4f 100644 > --- a/MdeModulePkg/Bus/Pci/XhciDxe/UsbHcMem.c > +++ b/MdeModulePkg/Bus/Pci/XhciDxe/UsbHcMem.c > @@ -267,6 +267,11 @@ UsbHcGetPciAddrForHostAddr ( > } > =20 > ASSERT ((Block !=3D NULL)); > + > + if (Block =3D=3D NULL) { > + return 0; > + } > + > // > // calculate the pci memory address for host memory address. > // > @@ -322,6 +327,11 @@ UsbHcGetHostAddrForPciAddr ( > } > =20 > ASSERT ((Block !=3D NULL)); > + > + if (Block =3D=3D NULL) { > + return 0; > + } > + > // > // calculate the pci memory address for host memory address. > // The above two changes are not good. There is a large number of call sites for these functions, and they never error-check the returned value. In effect, these functions must always succeed, or else there is a programming error somewhere in the driver (potentially the caller supplying incorrect inputs), or the hardware is broken. If the address mapping fails, we cannot do anything; we certainly cannot proceed with null pointers (either device zero addresses or host null pointers). Therefore, I suggest if (Block =3D=3D NULL) { CpuDeadLoop (); } instead. > @@ -603,6 +613,10 @@ UsbHcFreeMem ( > // > ASSERT (Block !=3D NULL); > =20 > + if (Block =3D=3D NULL) { > + return; > + } > + > // > // Release the current memory block if it is empty and not the head > // I'm not happy about this either, but at least this one doesn't directly make things worse than they are. Note the comment in the context: // // If Block =3D=3D NULL, it means that the current memory isn't // in the host controller's pool. This is critical because // the caller has passed in a wrong memory point // ASSERT (Block !=3D NULL); It says "critical", so I'd prefer a CpuDeadLoop() here too... Laszlo -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#110860): https://edk2.groups.io/g/devel/message/110860 Mute This Topic: https://groups.io/mt/102438127/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/leave/12367111/7686176/19134562= 12/xyzzy [rebecca@openfw.io] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-