[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[bug] hw/xen/xen-bus.c return type confusion and missing error handling
- To: Stefano Stabellini <sstabellini@xxxxxxxxxx>, Anthony PERARD <anthony@xxxxxxxxxxxxxx>, Paul Durrant <paul@xxxxxxx>, "Edgar E. Iglesias" <edgar.iglesias@xxxxxxxxx>
- From: Mark Syms <mark.syms@xxxxxxxxxx>
- Date: Mon, 14 Sep 2026 09:44:20 +0000
- Accept-language: en-GB, en-US
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=hVCM9Bd8dtXmxY2Pdmu4BEKJXZLE+qyH8JEtcseR1aw=; b=TA7vBxdOK7eF2nTi1Sy/8ynn8o0NsPuGmFKAZlPiOP5zNlyHNOWjXrEOzoLbkZ9WaSIGBbClQS++flAj4oolNu6wbwcfd3GUklKBG16ycqhqeXp1EJDQNTcvh8tqgi8h11wOhpyH9y7nF5UEhHFbVxWMi0tQdFHmspmh2YA1Tmu1SLVKWLlRvRKBigIGvrYpsdz3d+j8lUGug57kBXMfRFcwoImaA4wEKa9r9XMyiOJrcyqHZBDxJ+oSDn88+zxihjef+sWNeVS8yW3EJGRlKGfaWWmLQ/XBeoia79EfVKBCoQj2IDeqE9eOOtXeBRMvuf1z5M4NwP4cSXPGG8Qzmg==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=bu4LQQQLeOrvyQavYgmGeRAB7L/Q8S3GjfmFoBlroudlIyBnodyofSLY4iJhLLQBSjMmPE2yFC5gYayiCQA2knr2j0y+a9Y4EJVn/ehGqbe1ks/faC7w3EYbU881v28T+F8L4RZR9BuUdzZm1o0cfsOyXUPWEEo+xlBk4KUjh+wECgoKdFc4aVq1/UfSx8z8zSbCkf0ObqL21n5qKhLIVNRiZY94+6iIm9ejNS1LoHvqnNVdS4n/mSRCGINGKWixdsQ0c20xvcWYCT5GcBABYur9u/VhEKvzhgRtqN+wdOz2L5oGPUGFP7ta125XdzlL18I2ztW33h4qNfcVa8dBcg==
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck"
- Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com;
- Cc: "xen-devel@xxxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxxx>, "qemu-devel@xxxxxxxxxx" <qemu-devel@xxxxxxxxxx>
- Delivery-date: Mon, 14 Sep 2026 09:44:37 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
- Msip_labels:
- Thread-index: AQHdRC1AOIgl1NL+C0ast83t01+HHg==
- Thread-topic: [bug] hw/xen/xen-bus.c return type confusion and missing error handling
We found a bug in `xen_device_event` in `hw/xen/xen-bus.c`. The call
to `qemu_xen_evtchn_pending` places its return value into an `unsigned
long` variable. The function returns a signed int -
```c
static inline int qemu_xen_evtchn_pending(xenevtchn_handle *xc)
```
Thus, forcing this into an unsigned type sign extends a negative,
error, return. In particular `-1` which is the error return from
`xen_evtchn_ops->pending` will become `0xFFFFFFFFFFFFFFFF`. To further
exacerbate this there is no handling of an error return from this
call.
As things stand currently in the mainline this does not directly cause
a problem. But, if for some reason, in our case a buggy development
patch, an error is returned nothing distinguishes the return from a
benign port mismatch. If the event polling keeps reporting ready, the
event loop will re-enter immediately, resulting in a CPU spin.
Other callers of this function, in `xen_pvdev.c` & `xen-hvm-common.c`
store the return into an `evtchn_port_t` and check if the value does
not match the `local_port` and take appropriate action. Even this is a
bit questionable as `evtchn_port_t` is still unsigned.
Whilst this was exposed by a bug in some development code we were
working on we can't say whether this could occur for other reasons
such as the ring being filled.
I'm reporting this as an issue rather than via a patch as whilst we
have a fix in our local build it was generated by our corporate
agentic AI.
Regards,
Mark
XenServer Storage Engineering.
|
