lkml.org 
[lkml]   [2012]   [Feb]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    Subjectinteger overflows in kernel/relay.c
    My static checker is warning about integer overflows in kernel/relay.c

    relay_create_buf()
    170
    171 buf->padding = kmalloc(chan->n_subbufs * sizeof(size_t *), GFP_KERNEL);
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    This can only overflow on 32bit systems.

    172 if (!buf->padding)
    173 goto free_buf;
    174

    relay_open()
    582 chan->version = RELAYFS_CHANNEL_VERSION;
    583 chan->n_subbufs = n_subbufs;
    584 chan->subbuf_size = subbuf_size;
    585 chan->alloc_size = FIX_SIZE(subbuf_size * n_subbufs);
    ^^^^^^^^^^^^^^^^^^^^^^^
    586 chan->parent = parent;

    These come from the user in blk_trace_setup() and they aren't capped.
    I'm not sure what the maximum size to use is.

    regards,
    dan carpenter


    \
     
     \ /
      Last update: 2012-02-07 15:15    [W:0.022 / U:62.456 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site