From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
To: Christopher Li <sparse@chrisli.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>,
Linux-Sparse <linux-sparse@vger.kernel.org>
Subject: Re: [PATCH] ptrlist: use after free in last_ptr_list()
Date: Mon, 7 Nov 2016 11:00:37 +0100 [thread overview]
Message-ID: <20161107100036.GA443@macbook.home> (raw)
In-Reply-To: <20161106084937.GA818@macpro.local>
On Sun, Nov 06, 2016 at 09:49:38AM +0100, Luc Van Oostenryck wrote:
> On Sat, Nov 05, 2016 at 08:30:31AM +0800, Christopher Li wrote:
> > Those function originally all assume the list
> > are packed.
> >
> > Is there usage case in current sparse that
> > feed unpacked list to those function?
> >
> > Chris
OK, I've checked this on a more substantial amount of code
than the testsuite: the kernel for x86-64 with allyesconfig
and I confirm that there is not a single out-of-bounds access
to any ->list[], wich is what matters.
Nevertheless, there are two cases (in cse.c and evaluate.c)
where elements are deleted from a list which is not directly
repacked at the end of the loop and it's not obvious in the code
why it's OK to not repack them.
Luc
next prev parent reply other threads:[~2016-11-07 10:00 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-13 9:45 [PATCH] ptrlist: use after free in last_ptr_list() Dan Carpenter
2016-11-02 12:48 ` Luc Van Oostenryck
2016-11-02 14:52 ` Christopher Li
2016-11-02 15:23 ` Luc Van Oostenryck
2016-11-04 10:44 ` Luc Van Oostenryck
2016-11-05 0:30 ` Christopher Li
2016-11-06 8:49 ` Luc Van Oostenryck
2016-11-07 10:00 ` Luc Van Oostenryck [this message]
2016-11-16 22:46 ` Christopher Li
2016-11-16 23:22 ` Luc Van Oostenryck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161107100036.GA443@macbook.home \
--to=luc.vanoostenryck@gmail.com \
--cc=dan.carpenter@oracle.com \
--cc=linux-sparse@vger.kernel.org \
--cc=sparse@chrisli.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.