From patchwork Fri May 18 17:19:43 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 136332 Delivered-To: patch@linaro.org Received: by 2002:a2e:9706:0:0:0:0:0 with SMTP id r6-v6csp1507913lji; Fri, 18 May 2018 10:26:07 -0700 (PDT) X-Google-Smtp-Source: AB8JxZote7+Q+gLUk6rIirmAQex+BqQh8A31xkAi/HLRYziUHghSC/iyo8G7tSITr4hPLVf/aSIG X-Received: by 2002:a37:6456:: with SMTP id y83-v6mr9286594qkb.124.1526664367779; Fri, 18 May 2018 10:26:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1526664367; cv=none; d=google.com; s=arc-20160816; b=KdrsFptZKyobiYZTTVC8GYOvoZw9Lz6vFwf9vY+vUT2+tiecrpFLcCPJnzEf5/Vuwk ZHr/FsscQ5rMyN+7+boV8NcDTXPrx2Jz0Jc2qR8xeVA2q4jSvIYLT3rq1pJ/a1KyR3WZ VcCRNy8WwrNxj2fhCNuAeDQffrdQRd6YDAJr9WAeIB1em8K3IqRlFWcFGVsR4jpRNr97 FzE6yJ0xHXrVkY9VNknvWxDU6mIWaCSNUEdOsLyCiDDd00ojXKf/9XCP7Ak6y61zHGUy fMLdnnjU8U3V3ycXjRK1KNOknTNhFPp73CL0UfDY/n1vv+rSsJ7K/3JJHVmxQoEnaIfC siFg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:subject :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:to:from:arc-authentication-results; bh=tV6FFGBA+vnijcGIHnQHz486sNFIVhDVg9T0EhPQ5Yc=; b=1J9hVc3o0l8skx46ilTuAaupcSqSNbHlUT8Bgez49D6UnhzoYAYzQ9DbPobk0pX9pq 1ai33vlmG8JVnB7ypEYWp+JIG+A/eP2s79P3ssEQhk2bGKzWiQrPF08fIi+4SjHiRuxb aWbX6PP1st/co8HtSi02sEvXu+w8XMvj6vXdLHdVu5rjl/rjH4RYR6qsO2anHMhw47v8 U0zvqVVgC7cE8fvwpbtNXFha+QfHJf5fiw/H3+4s10+7dmAyE/uIdcGi0ISeEATx5lCI +R6kCwdM2ofFiPJxdHTSEf0Axadwg0e2kH/8XJr1WIwnXg6kGsPXy4+O8deLRFkFeTWx /inA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) smtp.mailfrom=qemu-devel-bounces+patch=linaro.org@nongnu.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [2001:4830:134:3::11]) by mx.google.com with ESMTPS id g28-v6si5417996qvb.234.2018.05.18.10.26.07 for (version=TLS1 cipher=AES128-SHA bits=128/128); Fri, 18 May 2018 10:26:07 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) client-ip=2001:4830:134:3::11; Authentication-Results: mx.google.com; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 2001:4830:134:3::11 as permitted sender) smtp.mailfrom=qemu-devel-bounces+patch=linaro.org@nongnu.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1]:40125 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fJj8p-00053u-6f for patch@linaro.org; Fri, 18 May 2018 13:26:07 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35903) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fJj3A-0000ZD-T9 for qemu-devel@nongnu.org; Fri, 18 May 2018 13:20:17 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fJj39-0007R1-Nv for qemu-devel@nongnu.org; Fri, 18 May 2018 13:20:16 -0400 Received: from orth.archaic.org.uk ([2001:8b0:1d0::2]:41782) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fJj39-0007PT-HR for qemu-devel@nongnu.org; Fri, 18 May 2018 13:20:15 -0400 Received: from pm215 by orth.archaic.org.uk with local (Exim 4.89) (envelope-from ) id 1fJj38-0004ly-LN for qemu-devel@nongnu.org; Fri, 18 May 2018 18:20:14 +0100 From: Peter Maydell To: qemu-devel@nongnu.org Date: Fri, 18 May 2018 18:19:43 +0100 Message-Id: <20180518172009.14416-7-peter.maydell@linaro.org> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180518172009.14416-1-peter.maydell@linaro.org> References: <20180518172009.14416-1-peter.maydell@linaro.org> MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2001:8b0:1d0::2 Subject: [Qemu-devel] [PULL 06/32] hw/arm/smmuv3: Fix Coverity issue in smmuv3_record_event X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" From: Eric Auger Coverity complains about use of uninitialized Evt struct. The EVT_SET_TYPE and similar setters use deposit32() on fields in the struct, so they read the uninitialized existing values. In cases where we don't set all the fields in the event struct we'll end up leaking random uninitialized data from QEMU's stack into the guest. Initializing the struct with "Evt evt = {};" ought to satisfy Coverity and fix the data leak. Signed-off-by: Eric Auger Reported-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-id: 1526493784-25328-2-git-send-email-eric.auger@redhat.com Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/arm/smmuv3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.17.0 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index b3026dea20..42dc521c13 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -143,7 +143,7 @@ static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt) void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info) { - Evt evt; + Evt evt = {}; MemTxResult r; if (!smmuv3_eventq_enabled(s)) {