lkml.org 
[lkml]   [2007]   [Mar]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [patch] [bugfix] loop.c
    On Fri, 23 Mar 2007, Eric Dumazet wrote:

    > - if (max_loop < 1 || max_loop > 256) {
    > - printk(KERN_WARNING "loop: invalid max_loop (must be between"
    > - " 1 and 256), using default (8)\n");
    > + if (max_loop < 1) {
    > + printk(KERN_WARNING "loop: invalid max_loop (must be > 1)"
    > + ", using default (8)\n");
    > max_loop = 8;
    > }
    [...]
    > + loop_dev = kmalloc(max_loop * sizeof(struct loop_device *), GFP_KERNEL);
    > + if (!loop_dev) {
    > + loop_dev = vmalloc(max_loop * sizeof(struct loop_device *));
    > + if (!loop_dev)
    > + goto out_mem;
    > + loop_dev_vmalloced = 1;
    > }

    Why did you remove the upper bound check for max_loop value? Now you
    effectively allow to max_loop * sizeof(struct loop_device *) to overflow,
    when passed value of max_loop which is large enough. Or am I just blind?

    The "while (nbl < max_loop)" which immediately follows is then going to
    corrupt memory, right?

    --
    Jiri Kosina
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-03-23 17:49    [W:0.024 / U:0.276 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site