Bugs in (2.6.18) from static analysis tool

Bugs in (2.6.18) from static analysis tool

[J R]

Hi,

We are in the final stages of refining a new static analysis framework and 
are testing it out on various large open source software projects (like 
other ventures in this space).

Unlike other enterprises, we are making a linux intraprocedural analysis 
tool openly available in binary form to allow our results to be reproduced 
and validated. Ditto the bug lists.

Although this is commercial software, our team are all strong OS advocates 
and contributors. We hope to release some components of this project on an 
OS basis just as soon as we can trash out a solid plan which allows this 
while also enabling us to purchase food.

I've only attached 1 or 2 bugs at the end here (the full list is about 10K 
ascii text), there are at www.cqsat.com/linux.html#bugs. There's about 50 
and I recon 20 or so are both real and not yet identified.

Any comments/issues/feedback is appreciated.

-J

==============================================================================
SEVERITY=[SERIOUS]
ISSUE=[Tainted expression (tmp).kb_table used as an index in this context. 
Expression bounds: [Upper bound unchecked]. Tracking "(tmp).kb_table": 
unsigned, 8 bit(s)]
SOURCE=[/p0/working/Downloads/linux-2.6.9/drivers/char/vt_ioctl.c, line 83]
SINK=[/p0/working/Downloads/linux-2.6.9/drivers/char/vt_ioctl.c, line 88]
ORIGINATOR=[cqsat]

      80:     struct kbentry tmp;
      81:     ushort *key_map, val, ov;
      82:
      83:     if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
          	^^^---------^^^----------^^^
          	START
      84:         return -EFAULT;
      86:     switch (cmd) {
      87:     case KDGKBENT:
      88:         key_map = key_maps[s];
          	^^^---------^^^----------^^^
          	ERROR
      89:         if (key_map) {
      90:             val = U(key_map[i]);
      91:             if (kbd->kbdmode != VC_UNICODE && KTYP(val) >= 
NR_TYPES)
      92:             val = K_HOLE;
==============================================================================

_________________________________________________________________
Be seen and heard with Windows Live Messenger and Microsoft LifeCams 
http://clk.atdmt.com/MSN/go/msnnkwme0020000001msn/direct/01/?href=http://www.microsoft.com/hardware/digitalcommunication/default.mspx?locale=en-us&source=hmtagline

Re: Bugs in (2.6.18) from static analysis tool

[Dave Jones]

On Wed, Oct 11, 2006 at 10:06:22PM -0700, J R wrote:
 > Hi,
 > 
 > We are in the final stages of refining a new static analysis framework and 
 > are testing it out on various large open source software projects (like 
 > other ventures in this space).
 > 
 > Unlike other enterprises, we are making a linux intraprocedural analysis 
 > tool openly available in binary form to allow our results to be reproduced 
 > and validated. Ditto the bug lists.
 > 
 > Although this is commercial software, our team are all strong OS advocates 
 > and contributors. We hope to release some components of this project on an 
 > OS basis just as soon as we can trash out a solid plan which allows this 
 > while also enabling us to purchase food.
 > 
 > I've only attached 1 or 2 bugs at the end here (the full list is about 10K 
 > ascii text), there are at www.cqsat.com/linux.html#bugs. There's about 50 
 > and I recon 20 or so are both real and not yet identified.

The bugs-2.6.18.txt file is the same as the bugs-2.6.9.txt file.

	Dave

-- 
http://www.codemonkey.org.uk

Re: Bugs in (2.6.18) from static analysis tool

[Andrew Morton]

On Wed, 11 Oct 2006 22:06:22 -0700
"J R" <x-list-subscriptions@hotmail.com> wrote:

> Hi,
> 
> We are in the final stages of refining a new static analysis framework and 
> are testing it out on various large open source software projects (like 
> other ventures in this space).
> 
> Unlike other enterprises, we are making a linux intraprocedural analysis 
> tool openly available in binary form to allow our results to be reproduced 
> and validated. Ditto the bug lists.
> 
> Although this is commercial software, our team are all strong OS advocates 
> and contributors. We hope to release some components of this project on an 
> OS basis just as soon as we can trash out a solid plan which allows this 
> while also enabling us to purchase food.
> 
> I've only attached 1 or 2 bugs at the end here (the full list is about 10K 
> ascii text), there are at www.cqsat.com/linux.html#bugs. There's about 50 
> and I recon 20 or so are both real and not yet identified.
> 
> Any comments/issues/feedback is appreciated.
> 

useful, thanks.

> 
> ==============================================================================
> SEVERITY=[SERIOUS]
> ISSUE=[Tainted expression (tmp).kb_table used as an index in this context. 
> Expression bounds: [Upper bound unchecked]. Tracking "(tmp).kb_table": 
> unsigned, 8 bit(s)]
> SOURCE=[/p0/working/Downloads/linux-2.6.9/drivers/char/vt_ioctl.c, line 83]
> SINK=[/p0/working/Downloads/linux-2.6.9/drivers/char/vt_ioctl.c, line 88]
> ORIGINATOR=[cqsat]
> 
>       80:     struct kbentry tmp;
>       81:     ushort *key_map, val, ov;
>       82:
>       83:     if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
>           	^^^---------^^^----------^^^
>           	START
>       84:         return -EFAULT;
>       86:     switch (cmd) {
>       87:     case KDGKBENT:
>       88:         key_map = key_maps[s];
>           	^^^---------^^^----------^^^
>           	ERROR
>       89:         if (key_map) {
>       90:             val = U(key_map[i]);
>       91:             if (kbd->kbdmode != VC_UNICODE && KTYP(val) >= 
> NR_TYPES)
>       92:             val = K_HOLE;

Yup, that's a bug.

Re: Bugs in (2.6.18) from static analysis tool

[jr]

[stuff deleted]
>  > I've only attached 1 or 2 bugs at the end
here(the full list is about 10K
>  > ascii text), there are at
www.cqsat.com/linux.html#bugs. There's about 50
>  > and I recon 20 or so are both real and not yet
identified.
>
>The bugs-2.6.18.txt file is the same as the
bugs-2.6.9.txt file.
>
>	Dave
^^^
Yes you are correct. That was dumm. Fixed now.

The 2.6.18 potential bug list is at
http://www.cqsat.com/bugs-2.6.18.txt

Sorry 'bout that

-J


>
>--
>http://www.codemonkey.org.uk

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com