lkml.org 
[lkml]   [2000]   [Aug]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subjectan assortment of suspicous stack allocations
Date
Hi,

we have a g++ extension that walks over all variable definitions in kernel
routines and warns if:
1. they sum to larger than 1024 bytes
2. gives warnings for suspiciously large variables (> 512)

It turned up a bunch of cases of 1K-4K drivers stacks. A representative
set is enclosed below. If this is something that is useful to people we're

I've included some representative errors at the end of the message.
We're currently hacking on a global checker that follows all call
chains, looking for overflows.

Dawson
-----------------------------------------------------------------
/u2/engler/ic/linux-2.3.99/drivers/isdn/sc/message.c:52:dump_messages: WARN: suspiciously large variable dpm: 4112 bytes!
/* * Dump message queue in shared memory to screen */
void dump_messages(int card){
DualPortMemory dpm;
----------------------------------------------------------
/u2/engler/ic/linux-2.3.99/drivers/scsi/qlogicfc.c:856:isp2x00_make_portdb: WARN: suspiciously large variable temp: 3072 bytes!
/u2/engler/ic/linux-2.3.99/drivers/scsi/qlogicfc.c:852:isp2x00_make_portdb: WARN: suspiciously large stack size: 3100 bytes!

static int isp2x00_make_portdb(struct Scsi_Host *host)
{
short param[8];
int i, j;
struct id_name_map temp[QLOGICFC_MAX_ID + 1];
struct isp2x00_hostdata *hostdata;
--------------------------------------------------------------------
/u2/engler/ic/linux-2.3.99/drivers/cdrom/optcd.c:1634:cdromread: WARN: suspiciously large variable buf: 2646 bytes!
/u2/engler/ic/linux-2.3.99/drivers/cdrom/optcd.c:1631:cdromread: WARN: suspiciously large stack size: 2656 bytes!
{
int status;
struct cdrom_msf msf;
----------------------------------------------------------------
-----------------------------------------------------------------------
[CONFIRMED]
/u2/engler/ic/linux-2.3.99/drivers/i2o/i2o_proc.c:840:i2o_proc_read_ddm_table: WARN: suspiciously large variable result: 2828 bytes!
/u2/engler/ic/linux-2.3.99/drivers/i2o/i2o_proc.c:814:i2o_proc_read_ddm_table: WARN: suspiciously large stack size: 2928 bytes!

/* Executive group 0003h - Executing DDM List (table) */
int i2o_proc_read_ddm_table(char *buf, char **start, off_t offset, int len,
int *eof, void *data)
{
struct i2o_controller *c = (struct i2o_controller*)data;
int token; int i;
typedef struct _i2o_exec_execute_ddm_table {
u16 ddm_tid;
u8 module_type;
u8 reserved;
u16 i2o_vendor_id;
u16 module_id;
u8 module_name_version[28];
u32 data_size;
u32 code_size;
} i2o_exec_execute_ddm_table;
struct
{
u16 result_count;
u16 pad;
u16 block_size;
u8 block_status;
u8 error_info_size;
u16 row_count;
u16 more_flag;
i2o_exec_execute_ddm_table ddm_table[MAX_I2O_MODULES];
} result;
-----------------------------------------------------------------------

[CONFIRMED] (same)

/u2/engler/ic/linux-2.3.99/drivers/i2o/i2o_proc.c:955:i2o_proc_read_drivers_stored: WARN: suspiciously large variable result: 3596 bytes!
/u2/engler/ic/linux-2.3.99/drivers/i2o/i2o_proc.c:927:i2o_proc_read_drivers_stored: WARN: suspiciously large stack size: 3720 bytes!

-----------------------------------------------------------------------
[CONFIRMED] (same)
/u2/engler/ic/linux-2.3.99/drivers/i2o/i2o_proc.c:1044:i2o_proc_read_groups: WARN: suspiciously large variable result: 2060 bytes!
/u2/engler/ic/linux-2.3.99/drivers/i2o/i2o_proc.c:1019:i2o_proc_read_groups: WARN: suspiciously large stack size: 2081 bytes!


-----------------------------------------------------------------------
[CONFIRMED] (same)
/u2/engler/ic/linux-2.3.99/drivers/i2o/i2o_proc.c:2261:i2o_proc_read_lan_mcast_addr: WARN: suspiciously large variable result: 2060 bytes!
/u2/engler/ic/linux-2.3.99/drivers/i2o/i2o_proc.c:2245:i2o_proc_read_lan_mcast_addr: WARN: suspiciously large stack size: 2080 bytes!

/u2/engler/ic/linux-2.3.99/drivers/cdrom/cdrom.c:724:cdrom_number_of_slots: WARN: suspiciously large variable info: 1032 bytes!
/u2/engler/ic/linux-2.3.99/drivers/cdrom/cdrom.c:721:cdrom_number_of_slots: WARN: suspiciously large stack size: 1040 bytes!

/u2/engler/ic/linux-2.3.99/drivers/cdrom/cdrom.c:765:cdrom_select_disc: WARN: suspiciously large variable info: 1032 bytes!
/u2/engler/ic/linux-2.3.99/drivers/cdrom/cdrom.c:764:cdrom_select_disc: WARN: suspiciously large stack size: 1040 bytes!

/u2/engler/ic/linux-2.3.99/drivers/cdrom/cdrom.c:1474:cdrom_ioctl: WARN: suspiciously large variable info: 1032 bytes!
/u2/engler/ic/linux-2.3.99/drivers/cdrom/cdrom.c:1411:cdrom_ioctl: WARN: suspiciously large stack size: 1140 bytes!



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:58    [from the cache]
©2003-2014 Jasper Spaans. Advertise on this site