From: Roland Dreier <rdreier@cisco.com>
To: Dan Carpenter <error27@gmail.com>
Cc: "Toralf Förster" <toralf.foerster@gmx.de>,
linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: bug list: range checking issues 2.6.34-rc1
Date: Tue, 16 Mar 2010 15:22:33 -0700 [thread overview]
Message-ID: <adar5nj9aae.fsf@roland-alpha.cisco.com> (raw)
In-Reply-To: <20100315101146.GL18181@bicker> (Dan Carpenter's message of "Mon, 15 Mar 2010 13:45:23 +0300")
> > drivers/infiniband/core/user_mad.c +646 ib_umad_reg_agent() 'umm' 4 <= 6
> 641 u32 *umm = (u32 *) ureq.method_mask;
> 642 int i;
> 643
> 644 for (i = 0; i < BITS_TO_LONGS(IB_MGMT_MAX_METHODS); ++i)
> 645 req.method_mask[i] =
> 646 umm[i * 2] | ((u64) umm[i * 2 + 1] << 32);
> "umm" points to a array with 4 elements.
> i can be 0 to 3, so "i * 2" goes up to 6
> And 4 <= 6 so it's a problem.
> Smatch also complained about "i * 2 + 1" but I didn't include that.
It's a bit tricky, but I believe this is a false positive. The code in
question is compatibility handling for 32-bit userspace on a 64-bit
kernel. In that case the range of i will be 0 to 1 (IB_MGMT_MAX_METHODS
is 128, so BITS_TO_LONGS on that is 2), and so we will only access
elements 0, 1, 2, and 3 of umm[], which is OK.
(Not sure how easily a static checker could find this; the code in
question is guarded by test of compat_method_mask, which can only be 1
if ib_umad_reg_agent() is called from ib_umad_compat_ioctl(), which will
only be built with CONFIG_COMPAT set, which can only happen on a 64-bit
architecture -- but it seems a bit hard for a checker to follow all that)
--
Roland Dreier <rolandd@cisco.com>
For corporate legal information go to:
http://www.cisco.com/web/about/doing_business/legal/cri/index.html
next prev parent reply other threads:[~2010-03-16 22:22 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <201003151002.18928.toralf.foerster@gmx.de>
2010-03-15 10:45 ` bug list: range checking issues 2.6.34-rc1 Dan Carpenter
2010-03-15 12:28 ` Toralf Förster
2010-03-16 22:22 ` Roland Dreier [this message]
2010-03-18 8:55 ` Dan Carpenter
2010-03-15 8:30 Dan Carpenter
2010-03-16 16:59 ` Tilman Schmidt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=adar5nj9aae.fsf@roland-alpha.cisco.com \
--to=rdreier@cisco.com \
--cc=error27@gmail.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=toralf.foerster@gmx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox