Re: [PATCH v8 37/43] dyndbg: harden classmap and descriptor validation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Off-by-one error in runtime classmap offset validation restricts the maximum valid class ID.
--

commit 9fc4489f7afee86c427de8b09e6f38f827d4fc24
Author: Jim Cromie <jim.cromie@gmail.com>

dyndbg: harden classmap and descriptor validation

This commit improves classmap and descriptor validation by mirroring
compile-time limits of _DEFINE and adding run-time overlap checks for _USEd
classmaps. It scans module descriptors at load time to warn about missing
class_ids instead of waiting for a user query.

> diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
> index a5d813ad323a1..b7ccf471b5efe 100644
> --- a/lib/dynamic_debug.c
> +++ b/lib/dynamic_debug.c
[ ... ]
> @@ -1524,10 +1543,47 @@ static int ddebug_add_module(struct _ddebug_info *di)
>  	dd_set_module_subrange(i, cm, &dt->info, maps);
>  	dd_set_module_subrange(i, cli, &dt->info, users);
>  
> -	/* insure 2+ classmaps share the per-module 0..62 class_id space */
> +	/* validate the per-module shared 0..62 class_id space */
>  	for_subvec(i, cm, &dt->info, maps)
>  		if (ddebug_class_range_overlap(cm, &reserved_ids))
> -			goto cleanup;
> +			err = -EINVAL;
> +
> +	for_subvec(i, cli, &dt->info, users) {
> +		cm = cli->map;
> +		if (!cm) {
> +			pr_err("module %s: classmap not found for user\n", di->mod_name);
> +			err = -EINVAL;
> +			continue;
> +		}
> +
> +		if (cm->base + cm->length + cli->offset >= _DPRINTK_CLASS_DFLT) {

[Severity: Medium]
Does this condition have an off-by-one error that restricts the maximum valid
class ID?

The _DPRINTK_CLASS_DFLT macro is defined as 63, which means valid class IDs
range from 0 to 62. The maximum assigned class ID for a given map and offset is
base + length + offset - 1. If base + length + offset == 63, the maximum
assigned class ID is exactly 62, which should be valid.

Because the code checks if the sum is >= _DPRINTK_CLASS_DFLT, a valid
boundary case of 63 is erroneously flagged as an error. This shrinks the valid
class ID space to 0..61 instead of the expected 0..62.

> +			pr_err("module %s: base:%d + classes.len:%d + cli.offset:%d must be < %d\n",
> +			       di->mod_name, cm->base, cm->length,
> +			       cli->offset, _DPRINTK_CLASS_DFLT);
> +			err = -EINVAL;
> +			continue;
> +		}
> +
> +		if (ddebug_class_user_overlap(cli, &reserved_ids))
> +			err = -EINVAL;
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260905-dd-cmap-part2-clean-v8-0-a4cc0674f6fd@gmail.com?part=37