Messages in this thread | | | Date | Tue, 7 Feb 2012 17:11:55 +0300 | From | Dan Carpenter <> | Subject | integer overflows in kernel/relay.c |
| |
My static checker is warning about integer overflows in kernel/relay.c
relay_create_buf() 170 171 buf->padding = kmalloc(chan->n_subbufs * sizeof(size_t *), GFP_KERNEL); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ This can only overflow on 32bit systems.
172 if (!buf->padding) 173 goto free_buf; 174
relay_open() 582 chan->version = RELAYFS_CHANNEL_VERSION; 583 chan->n_subbufs = n_subbufs; 584 chan->subbuf_size = subbuf_size; 585 chan->alloc_size = FIX_SIZE(subbuf_size * n_subbufs); ^^^^^^^^^^^^^^^^^^^^^^^ 586 chan->parent = parent;
These come from the user in blk_trace_setup() and they aren't capped. I'm not sure what the maximum size to use is.
regards, dan carpenter
| |