RE: [PATCH] stm class: Fix out of bound access from bitmap allocation

From: David Laight <David.Laight@ACULAB.COM>
To: 'Robin Murphy' <robin.murphy@arm.com>,
	Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>,
	Alexander Shishkin <alexander.shishkin@linux.intel.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Mulu He <muluhe@codeaurora.org>,
	Tingwei Zhang <tingwei@codeaurora.org>,
	Maxime Coquelin <mcoquelin.stm32@gmail.com>,
	Alexandre Torgue <alexandre.torgue@st.com>,
	"linux-stm32@st-md-mailman.stormreply.com"
	<linux-stm32@st-md-mailman.stormreply.com>,
	Mathieu Poirier <mathieu.poirier@linaro.org>,
	Suzuki K Poulose <suzuki.poulose@arm.com>,
	Mike Leach <mike.leach@linaro.org>, Leo Yan <leo.yan@linaro.org>
Cc: Rajendra Nayak <rnayak@codeaurora.org>,
	"linux-arm-msm@vger.kernel.org" <linux-arm-msm@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"stable@vger.kernel.org" <stable@vger.kernel.org>,
	Sibi Sankar <sibis@codeaurora.org>,
	Vivek Gautam <vivek.gautam@codeaurora.org>,
	"linux-arm-kernel@lists.infradead.org"
	<linux-arm-kernel@lists.infradead.org>
Subject: RE: [PATCH] stm class: Fix out of bound access from bitmap allocation
Date: Mon, 8 Apr 2019 10:33:51 +0000	[thread overview]
Message-ID: <2d5e435bf7b344fb835fc58ac36e1c19@AcuMS.aculab.com> (raw)
In-Reply-To: <850ba66b-0e4a-2027-5640-0ee339a7868c@arm.com>

From: Robin Murphy
> Sent: 08 April 2019 11:24
> On 07/04/2019 05:31, Sai Prakash Ranjan wrote:
> > On 4/5/2019 6:44 PM, David Laight wrote:
> >> From: Sai Prakash Ranjan
> >>>
> >>> diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
> >>> index 93ce3aa740a9..21a5838f6e67 100644
> >>> --- a/drivers/hwtracing/stm/core.c
> >>> +++ b/drivers/hwtracing/stm/core.c
> >>> @@ -168,7 +168,7 @@ static int stp_master_alloc(struct stm_device
> >>> *stm, unsigned int idx)
> >>>       struct stp_master *master;
> >>>       size_t size;
> >>>
> >>> -    size = ALIGN(stm->data->sw_nchannels, 8) / 8;
> >>> +    size = ALIGN(stm->data->sw_nchannels, STM_MASTER_SZ) /
> >>> STM_MASTER_SZ;
> >>
> >> I'm not sure that using STP_MASTER_SZ improves readability at all.
> >>
> >
> > I thought it was better to have a macro than directly specifying
> > sizeof(unsigned long), anyways I can change it.
> >
> >> Is there something that gives the size of a bitmap for 'n' items?
> >>
> >
> > Not sure if there is something.
> 
> If you were to ask the question "how does the bitmap code itself know
> what the total size of a bitmap is?", that would quickly lead you
> towards BITS_TO_LONGS() ;)
> 
> And given that stp_master::chan_map is already an appropriate type, that
> suggests simplifying the entire calculation down to something neat and
> tidy like:
> 
> size = offsetof(struct stp_master, chan_map[BITS_TO_LONGS(stm->data->sw_nchannels)]);

Except that is invalid.
You can't use offsetof() with something that isn't a compile time constant.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel