All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Michael S. Tsirkin" <mst@redhat.com>
To: Daniil Tatianin <d-tatianin@yandex-team.ru>
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
	kvm@vger.kernel.org, virtualization@lists.linux-foundation.org
Subject: Re: [PATCH v1] drivers/vhost/vhost: fix overflow checks in vhost_overflow
Date: Wed, 7 Dec 2022 10:01:53 -0500	[thread overview]
Message-ID: <20221207100028-mutt-send-email-mst@kernel.org> (raw)
In-Reply-To: <20221207134631.907221-1-d-tatianin@yandex-team.ru>

On Wed, Dec 07, 2022 at 04:46:31PM +0300, Daniil Tatianin wrote:
> The if statement would erroneously check for > ULONG_MAX, which could
> never evaluate to true. Check for equality instead.
> 
> Found by Linux Verification Center (linuxtesting.org) with the SVACE
> static analysis tool.
> 
> Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>

It can trigger on a 32 bit system. I'd also expect more analysis
of the code flow than "this can not trigger switch to a condition
that can" to accompany a patch.

> ---
>  drivers/vhost/vhost.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
> index 40097826cff0..8df706e7bc6c 100644
> --- a/drivers/vhost/vhost.c
> +++ b/drivers/vhost/vhost.c
> @@ -730,7 +730,7 @@ static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz)
>  /* Make sure 64 bit math will not overflow. */
>  static bool vhost_overflow(u64 uaddr, u64 size)
>  {
> -	if (uaddr > ULONG_MAX || size > ULONG_MAX)
> +	if (uaddr == ULONG_MAX || size == ULONG_MAX)
>  		return true;
>  
>  	if (!size)
> -- 
> 2.25.1

_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization

WARNING: multiple messages have this Message-ID (diff)
From: "Michael S. Tsirkin" <mst@redhat.com>
To: Daniil Tatianin <d-tatianin@yandex-team.ru>
Cc: Jason Wang <jasowang@redhat.com>,
	kvm@vger.kernel.org, virtualization@lists.linux-foundation.org,
	netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v1] drivers/vhost/vhost: fix overflow checks in vhost_overflow
Date: Wed, 7 Dec 2022 10:01:53 -0500	[thread overview]
Message-ID: <20221207100028-mutt-send-email-mst@kernel.org> (raw)
In-Reply-To: <20221207134631.907221-1-d-tatianin@yandex-team.ru>

On Wed, Dec 07, 2022 at 04:46:31PM +0300, Daniil Tatianin wrote:
> The if statement would erroneously check for > ULONG_MAX, which could
> never evaluate to true. Check for equality instead.
> 
> Found by Linux Verification Center (linuxtesting.org) with the SVACE
> static analysis tool.
> 
> Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>

It can trigger on a 32 bit system. I'd also expect more analysis
of the code flow than "this can not trigger switch to a condition
that can" to accompany a patch.

> ---
>  drivers/vhost/vhost.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
> index 40097826cff0..8df706e7bc6c 100644
> --- a/drivers/vhost/vhost.c
> +++ b/drivers/vhost/vhost.c
> @@ -730,7 +730,7 @@ static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz)
>  /* Make sure 64 bit math will not overflow. */
>  static bool vhost_overflow(u64 uaddr, u64 size)
>  {
> -	if (uaddr > ULONG_MAX || size > ULONG_MAX)
> +	if (uaddr == ULONG_MAX || size == ULONG_MAX)
>  		return true;
>  
>  	if (!size)
> -- 
> 2.25.1


  reply	other threads:[~2022-12-07 15:02 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-12-07 13:46 [PATCH v1] drivers/vhost/vhost: fix overflow checks in vhost_overflow Daniil Tatianin
2022-12-07 15:01 ` Michael S. Tsirkin [this message]
2022-12-07 15:01   ` Michael S. Tsirkin
2022-12-08  7:21   ` Daniil Tatianin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221207100028-mutt-send-email-mst@kernel.org \
    --to=mst@redhat.com \
    --cc=d-tatianin@yandex-team.ru \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=virtualization@lists.linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.