lkml.org 
[lkml]   [2009]   [Sep]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 8/9] Add explicit bound checks in mm/migrate.c
    On Sat, 26 Sep 2009 20:54:06 +0200
    Arjan van de Ven <arjan@infradead.org> wrote:

    > From: Arjan van de Ven <arjan@linux.intel.com>
    > Subject: [PATCH 8/9] Add explicit bound checks in mm/migrate.c
    > CC: akpm@linux-foundation.org
    >
    > The memory migration code has some curious copy_from_user bounds,
    > that are likely ok, but are not immediately obvious to me or to GCC.
    >
    > This patch adds a simple explicit bound check; this allows GCC
    > and me to be more assured that the copy_from_user will never overwrite
    > its destination buffer.

    I don't really see what's being fixed here. The original code seems
    straightforward and safe enough?

    The identifier `chunk_nr' is a bit ambiguous. Is it "number of chunks" or
    is it "index of this chunk"?

    >
    > diff --git a/mm/migrate.c b/mm/migrate.c
    > index 1a4bf48..5b9ebc5 100644
    > --- a/mm/migrate.c
    > +++ b/mm/migrate.c
    > @@ -1044,11 +1044,15 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
    > int err;
    >
    > for (i = 0; i < nr_pages; i += chunk_nr) {
    > + unsigned int copy;
    > if (chunk_nr + i > nr_pages)
    > chunk_nr = nr_pages - i;

    A newline after end-of-locals is conventional.

    `i' and `chunk_nr' have type `unsigned long' and you're mixing that up
    with `unsigned int'.

    > - err = copy_from_user(chunk_pages, &pages[i],
    > - chunk_nr * sizeof(*chunk_pages));

    And we mix it up with size_t as well.

    The type choices are a bit confused and sloppy. Converting it all to
    `unsigned int' should be OK.

    > + copy = chunk_nr * sizeof(*chunk_pages);
    > + if (copy > DO_PAGES_STAT_CHUNK_NR)
    > + return -EFAULT;
    > +
    > + err = copy_from_user(chunk_pages, &pages[i], copy);
    > if (err) {
    > err = -EFAULT;
    > goto out;




    \
     
     \ /
      Last update: 2009-10-01 00:23    [W:0.029 / U:59.448 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site