question about blkio_get_stat()

question about blkio_get_stat()

[Dan Carpenter]

Hi Divyesh,

Smatch complains that we go outside the array in blkio_get_stat().

block/blk-cgroup.c
   731          if (type == BLKIO_STAT_DEQUEUE)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^
BLKIO_STAT_DEQUEUE is 9.

   732                  return blkio_fill_stat(key_str, MAX_KEY_LEN - 1,
   733                                          blkg->stats.dequeue, cb, dev);
   734  #endif
   735  
   736          for (sub_type = BLKIO_STAT_READ; sub_type < BLKIO_STAT_TOTAL;
   737                          sub_type++) {
   738                  blkio_get_key_name(sub_type, dev, key_str, MAX_KEY_LEN, false);
   739                  cb->fill(cb, key_str, blkg->stats.stat_arr[type][sub_type]);
                                                    ^^^^^^^^^^^^^^^^^^^^
This array only has 4 elements and if "type" is 9 we're past the end of
array.

   740          }

It's odd that Smatch only started complaining about this now, but this
code has been there for years.  I'm puzzled by what changed.  Sorry if
there is something obvious I have missed.

regards,
dan carpenter

Re: question about blkio_get_stat()

[Jan Kara]

  Hi,

On Mon 02-04-12 16:54:56, Dan Carpenter wrote:
> Smatch complains that we go outside the array in blkio_get_stat().
> 
> block/blk-cgroup.c
>    731          if (type == BLKIO_STAT_DEQUEUE)
>                     ^^^^^^^^^^^^^^^^^^^^^^^^^^
> BLKIO_STAT_DEQUEUE is 9.
> 
>    732                  return blkio_fill_stat(key_str, MAX_KEY_LEN - 1,
>    733                                          blkg->stats.dequeue, cb, dev);
>    734  #endif
>    735  
>    736          for (sub_type = BLKIO_STAT_READ; sub_type < BLKIO_STAT_TOTAL;
>    737                          sub_type++) {
>    738                  blkio_get_key_name(sub_type, dev, key_str, MAX_KEY_LEN, false);
>    739                  cb->fill(cb, key_str, blkg->stats.stat_arr[type][sub_type]);
>                                                     ^^^^^^^^^^^^^^^^^^^^
> This array only has 4 elements and if "type" is 9 we're past the end of
> array.
> 
>    740          }
> 
> It's odd that Smatch only started complaining about this now, but this
> code has been there for years.  I'm puzzled by what changed.  Sorry if
> there is something obvious I have missed.
  It seems that BLKIO_STAT_... values larger than BLK_IO_STAT_QUEUE are
defined only if CONFIG_DEBUG_BLK_CGROUP is defined. And in that case they
are also handled by blkio_get_stat() in a special way so we never get to
computing blkg->stats.stat_arr[type][sub_type]. So everything seems fine.

								Honza
-- 
Jan Kara <jack@suse.cz>
SUSE Labs, CR