Re: [patch] [bugfix] loop.c

[Michael Tokarev <mjt@tls.msk.ru>]

Eric Dumazet wrote:
[]
> 
> MODULE_PARM_DESC(max_loop, "Maximum number of loop devices (1-16384)");

Speaking of which, I wonder...  Here, and in many other places.

If some variable is marked as MODULE_PARAM (or whatever it is called
nowadays), used in module init routine, AND subsequently used for various
bound checks and loops...

Consider this:

  MODULE_PARAM(n);
  foo_init() {
    mem = kmalloc(n * sizeof(void*));
    ..
  }
  foo_func() {
    for (i = 0; i < n; ++i)
      do_something_with_mem(mem[i])
  }

and so on.  Together with:

  # modprobe foo n=10
  # echo 20 > /sys/module/foo/parameters/n

After that, we have 10 entries in mem[], and
n is equal to 20, so the for-loop above will be
up to i=19.  Which will reference unallocated
memory....

Amd I dreaming?

Thanks.

/mjt