Messages in this thread | | | From | KOSAKI Motohiro <> | Subject | Re: [PATCH 8/9] Add explicit bound checks in mm/migrate.c | Date | Thu, 1 Oct 2009 14:54:59 +0900 (JST) |
| |
Hi
> On Sat, 26 Sep 2009 20:54:06 +0200 > Arjan van de Ven <arjan@infradead.org> wrote: > > > From: Arjan van de Ven <arjan@linux.intel.com> > > Subject: [PATCH 8/9] Add explicit bound checks in mm/migrate.c > > CC: akpm@linux-foundation.org > > > > The memory migration code has some curious copy_from_user bounds, > > that are likely ok, but are not immediately obvious to me or to GCC. > > > > This patch adds a simple explicit bound check; this allows GCC > > and me to be more assured that the copy_from_user will never overwrite > > its destination buffer. > > I don't really see what's being fixed here. The original code seems > straightforward and safe enough?
I think original code is safe too.
> The identifier `chunk_nr' is a bit ambiguous. Is it "number of chunks" or > is it "index of this chunk"?
chunk_nr is batch size. (ie it's number of chunks)
Plus, I have a review comment.
> > > > > diff --git a/mm/migrate.c b/mm/migrate.c > > index 1a4bf48..5b9ebc5 100644 > > --- a/mm/migrate.c > > +++ b/mm/migrate.c > > @@ -1044,11 +1044,15 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages, > > int err; > > > > for (i = 0; i < nr_pages; i += chunk_nr) { > > + unsigned int copy; > > if (chunk_nr + i > nr_pages) > > chunk_nr = nr_pages - i; > > A newline after end-of-locals is conventional. > > `i' and `chunk_nr' have type `unsigned long' and you're mixing that up > with `unsigned int'. > > > - err = copy_from_user(chunk_pages, &pages[i], > > - chunk_nr * sizeof(*chunk_pages)); > > And we mix it up with size_t as well. > > The type choices are a bit confused and sloppy. Converting it all to > `unsigned int' should be OK. > > > + copy = chunk_nr * sizeof(*chunk_pages); > > + if (copy > DO_PAGES_STAT_CHUNK_NR) > > + return -EFAULT;
this seems a bit strange. the unit of copy is byte. but the unit of DO_PAGES_STAT_CHUNK_NR is not byte.
> > + > > + err = copy_from_user(chunk_pages, &pages[i], copy); > > if (err) { > > err = -EFAULT; > > goto out; > >
| |