Messages in this thread | | | Date | Wed, 26 Nov 2014 14:06:47 -0500 | From | Sasha Levin <> | Subject | Re: [RFC 2/2] kvm: eventfd: detect integer overflow using check_*_overflow |
| |
On 11/26/2014 01:23 PM, Linus Torvalds wrote: > On Wed, Nov 26, 2014 at 9:55 AM, Sasha Levin <sasha.levin@oracle.com> wrote: >> > >> > Good point. Do you think there's an advantage in using GCC's overflow >> > checker in this case? > No. However, if your coccinelle script can be changed to verify that > the type of the expression is unsigned, _that_ would be useful.
I'm pretty sure that this is something GCC will warn you about in the compilation stage.
> And the "multiplication overflow" may actually be a way to generate > better code. Possibly. I'm not entirely sure exactly what gcc actually > does. How many multiplication overflow tests do we actually have, > though?
Well, there are two straightforward checks in the kcalloc() family. They're not the issue though. The problem is the *unchecked* *signed* integer overflows lurking around.
kernel/time/ntp.c:process_adjtimex_modes():
if (txc->modes & ADJ_FREQUENCY) { time_freq = txc->freq * PPM_SCALE; <=== Undefined overflow time_freq = min(time_freq, MAXFREQ_SCALED); time_freq = max(time_freq, -MAXFREQ_SCALED); /* update pps_freq */ pps_set_freq(time_freq); }
The multiplication is between signed integers, and it overflows (user triggerable).
Thanks, Sasha
| |