From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id A07BA941888 for ; Tue, 7 Nov 2023 16:41:37 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=tI1lchbuKFBAaAg2W8D4YgXQNyX9RlnPfsTyRGWK18s=; c=relaxed/simple; d=groups.io; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From:In-Reply-To:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Language:Content-Type:Content-Transfer-Encoding; s=20140610; t=1699375296; v=1; b=KrXngdVyWO4ftXGxrOfDYnQAby9LNsaPZPb0DSj5X3P+1L4F+56UKn3TqtCE03/35uyK8NzO vRtcvf7avsetR63ahFHv3dp8GwaYuF7TXy1O5aT6ym8ooJVPJm8QcVBHWgOZTdxnVwa3MhK9FIm rPehBDkgOGSDPjXhoT2UfOyw= X-Received: by 127.0.0.2 with SMTP id ejYVYY7687511xPo0hjsntf2; Tue, 07 Nov 2023 08:41:36 -0800 X-Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.groups.io with SMTP id smtpd.web11.15668.1699375295330482285 for ; Tue, 07 Nov 2023 08:41:35 -0800 X-Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-449-kCb6BBzwNx2Tsy9LjaGMIQ-1; Tue, 07 Nov 2023 11:41:32 -0500 X-MC-Unique: kCb6BBzwNx2Tsy9LjaGMIQ-1 X-Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 501638870E5; Tue, 7 Nov 2023 16:41:26 +0000 (UTC) X-Received: from [10.39.193.64] (unknown [10.39.193.64]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 78775492BEE; Tue, 7 Nov 2023 16:41:25 +0000 (UTC) Message-ID: Date: Tue, 7 Nov 2023 17:41:24 +0100 MIME-Version: 1.0 Subject: Re: [edk2-devel] [PATCH v2 3/5] MdeModulePkg/Bus/Pci/PciBusDxe: Fix ARRAY_VS_SINGLETON Coverity issues To: devel@edk2.groups.io, rsingh@ventanamicro.com Cc: Ray Ni , Veeresh Sangolli References: <20231107061959.113213-1-rsingh@ventanamicro.com> <20231107061959.113213-4-rsingh@ventanamicro.com> From: "Laszlo Ersek" In-Reply-To: <20231107061959.113213-4-rsingh@ventanamicro.com> X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,lersek@redhat.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: YSDoibVJcpW0MwfsP5hH6iK7x7686176AA= Content-Language: en-US Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=KrXngdVy; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=redhat.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io On 11/7/23 07:19, Ranbir Singh wrote: > From: Ranbir Singh >=20 > The function PciHostBridgeResourceAllocator is not making use of the > generic approach as is used in one of the other function namely - > DumpResourceMap. As a result, the following warnings can be seen as > reported by Coverity e.g. >=20 > (30) Event address_of: Taking address with "&IoBridge" yields a > singleton pointer. > (31) Event callee_ptr_arith: Passing "&IoBridge" to function > "FindResourceNode" which uses it as an array. This might corrupt > or misinterpret adjacent memory locations. >=20 > Hence, adopt the generic approach to fix the issues at relevant points. >=20 > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4239 >=20 > Cc: Ray Ni > Co-authored-by: Veeresh Sangolli > Signed-off-by: Ranbir Singh > Signed-off-by: Ranbir Singh > --- > MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c | 37 ++++++++++++++++---- > 1 file changed, 31 insertions(+), 6 deletions(-) >=20 > diff --git a/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c b/MdeModulePkg/Bus/P= ci/PciBusDxe/PciLib.c > index 84fc0161a19c..71767d3793d4 100644 > --- a/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c > +++ b/MdeModulePkg/Bus/Pci/PciBusDxe/PciLib.c > @@ -485,6 +485,8 @@ PciHostBridgeResourceAllocator ( > UINT64 Mem64ResStatus; > UINT64 PMem64ResStatus; > UINT32 MaxOptionRomSize; > + PCI_RESOURCE_NODE **ChildResources; > + UINTN ChildResourceCount; > PCI_RESOURCE_NODE *IoBridge; > PCI_RESOURCE_NODE *Mem32Bridge; > PCI_RESOURCE_NODE *PMem32Bridge; > @@ -895,16 +897,39 @@ PciHostBridgeResourceAllocator ( > // Create the entire system resource map from the information collec= ted by > // enumerator. Several resource tree was created > // > - FindResourceNode (RootBridgeDev, &IoPool, &IoBridge); > - FindResourceNode (RootBridgeDev, &Mem32Pool, &Mem32Bridge); > - FindResourceNode (RootBridgeDev, &PMem32Pool, &PMem32Bridge); > - FindResourceNode (RootBridgeDev, &Mem64Pool, &Mem64Bridge); > - FindResourceNode (RootBridgeDev, &PMem64Pool, &PMem64Bridge); > - > + ChildResourceCount =3D FindResourceNode (RootBridgeDev, &IoPool, NUL= L); > + ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_NODE *) * Chil= dResourceCount); > + ASSERT (ChildResources !=3D NULL); > + FindResourceNode (RootBridgeDev, &IoPool, &ChildResources[0]); > + IoBridge =3D ChildResources[0]; > ASSERT (IoBridge !=3D NULL); > + > + ChildResourceCount =3D FindResourceNode (RootBridgeDev, &Mem32Pool, = NULL); > + ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_NODE *) * Chil= dResourceCount); > + ASSERT (ChildResources !=3D NULL); > + FindResourceNode (RootBridgeDev, &Mem32Pool, &ChildResources[0]); > + Mem32Bridge =3D ChildResources[0]; > ASSERT (Mem32Bridge !=3D NULL); > + > + ChildResourceCount =3D FindResourceNode (RootBridgeDev, &PMem32Pool,= NULL); > + ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_NODE *) * Chil= dResourceCount); > + ASSERT (ChildResources !=3D NULL); > + FindResourceNode (RootBridgeDev, &PMem32Pool, &ChildResources[0]); > + PMem32Bridge =3D ChildResources[0]; > ASSERT (PMem32Bridge !=3D NULL); > + > + ChildResourceCount =3D FindResourceNode (RootBridgeDev, &Mem64Pool, = NULL); > + ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_NODE *) * Chil= dResourceCount); > + ASSERT (ChildResources !=3D NULL); > + FindResourceNode (RootBridgeDev, &Mem64Pool, &ChildResources[0]); > + Mem64Bridge =3D ChildResources[0]; > ASSERT (Mem64Bridge !=3D NULL); > + > + ChildResourceCount =3D FindResourceNode (RootBridgeDev, &PMem64Pool,= NULL); > + ChildResources =3D AllocatePool (sizeof (PCI_RESOURCE_NODE *) * Chil= dResourceCount); > + ASSERT (ChildResources !=3D NULL); > + FindResourceNode (RootBridgeDev, &PMem64Pool, &ChildResources[0]); > + PMem64Bridge =3D ChildResources[0]; > ASSERT (PMem64Bridge !=3D NULL); > =20 > // Sorry, but this is terrible. * First of all, Coverity is *wrong*. The C spec clearly states that, for the purposes of pointer arithmetic, a singleton object behaves identically to the first element of an array. So, immediately, the idea arises that we should just use PCI_RESOURCE_NODE *IoBridgeArray[1]; FindResourceNode (RootBridgeDev, &IoPool, IoBridgeArray) to shut up Coverity. * Unfortunately, I expect that would only create a different warning: a warning about potentially overflowing this single-element array. Which is in fact a deeper problem in FindResourceNode() -- it happily overwrites an array that is too small. * Finally, this generic approach is both ugly (lots of code duplication!), and worse, it allocates memory without proper error checking (ASSERT() is not error checking), and then it leaks ChildResources *multiple times*! I suggest the following, for solving all of these issues: - create a function called FindFirstResourceNode(). It should have the same function prototype as FindResourceNode(), except the last parameter should be mandatory, not OPTIONAL. - the internal logic should be the same, except we shouldn't be counting, the return value should be a BOOLEAN. If we find a match, then output the first match and return TRUE. Otherwise, set the output to NULL and return FALSE. - replace the FindResourceNode calls with FindFirstResourceNode calls - Those call sites are already followed by ASSERT()s, saying that all search attempts will succeed. If coverity is happy with them, that's good; otherwise, we'll have to find a solution for them as well. Laszlo -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#110864): https://edk2.groups.io/g/devel/message/110864 Mute This Topic: https://groups.io/mt/102438300/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/leave/12367111/7686176/19134562= 12/xyzzy [rebecca@openfw.io] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-