Open
Description
*** CID 178601: Integer handling issues (BAD_SHIFT)
/arch/powerpc/include/asm/kvm_book3s_64.h: 247 in compute_tlbie_rb()
241 } else {
242 int aval_shift;
243 /*
244 * remaining bits of AVA/LP fields
245 * Also contain the rr bits of LP
246 */
>>> CID 178601: Integer handling issues (BAD_SHIFT)
>>> In expression "va_low << b_pgshift", shifting by a negative amount has undefined behavior. The shift amount, "b_pgshift", is -1.
247 rb |= (va_low << b_pgshift) & 0x7ff000;
248 /*
249 * Now clear not needed LP bits based on actual psize
250 */
251 rb &= ~((1ul << a_pgshift) - 1);
252 /*
*** CID 178619: Code maintainability issues (UNUSED_VALUE)
/arch/powerpc/kvm/book3s_64_mmu_radix.c: 576 in kvmppc_hv_get_dirty_log_radix()
570 * Since we have at most one PTE covering any given guest
571 * real address, if npages > 1 we can skip to i + npages.
572 */
573 j = i + 1;
574 if (npages) {
575 set_dirty_bits(map, i, npages);
>>> CID 178619: Code maintainability issues (UNUSED_VALUE)
>>> Assigning value from "j + npages" to "i" here, but that stored value is overwritten before it can be used.
576 i = j + npages;
577 }
578 }
579 return 0;
580 }
*** CID 178617: Integer handling issues (BAD_SHIFT)
/arch/powerpc/include/asm/kvm_book3s_64.h: 162 in kvmppc_actual_pgsz()
156 tmp >>= 8;
157 return tmp;
158 }
159
160 static inline unsigned long kvmppc_actual_pgsz(unsigned long v, unsigned long r)
161 {
>>> CID 178617: Integer handling issues (BAD_SHIFT)
>>> In expression "1UL << kvmppc_hpte_actual_page_shift(v, r)", shifting by a negative amount has undefined behavior. The shift amount, "kvmppc_hpte_actual_page_shift(v, r)", is -1.
162 return 1ul << kvmppc_hpte_actual_page_shift(v, r);
163 }
164
165 static inline int kvmppc_pgsize_lp_encoding(int base_shift, int actual_shift)
166 {
167 switch (base_shift) {
*** CID 178606: Insecure data handling (TAINTED_SCALAR)
/arch/powerpc/kvm/book3s_hv_builtin.c: 658 in wait_for_sync()
652 static void wait_for_sync(struct kvm_split_mode *sip, int phase)
653 {
654 int thr = local_paca->kvm_hstate.tid;
655
656 sip->lpcr_sync.phase[thr] |= phase;
657 phase = ALL(phase);
>>> CID 178606: Insecure data handling (TAINTED_SCALAR)
>>> Using tainted variable "phase" as a loop boundary.
658 while ((sip->lpcr_sync.allphases & phase) != phase) {
659 HMT_low();
660 barrier();
661 }
662 HMT_medium();
663 }
Metadata
Metadata
Assignees
Type
Projects
Status
Stale