lkml.org 
[lkml]   [2019]   [Oct]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: KASAN: slab-out-of-bounds Read in build_audio_procunit
On Mon, 28 Oct 2019 15:34:06 +0100,
Dan Carpenter wrote:
>
> I wish that this could have been detected with static analysis...
>
> On Tue, Oct 22, 2019 at 05:45:14PM +0200, Takashi Iwai wrote:
> > diff --git a/sound/usb/validate.c b/sound/usb/validate.c
> > index 3c8f73a0eb12..a5e584b60dcd 100644
> > --- a/sound/usb/validate.c
> > +++ b/sound/usb/validate.c
> > @@ -75,7 +75,7 @@ static bool validate_processing_unit(const void *p,
> >
> > if (d->bLength < sizeof(*d))
> ^^^^^^^^^^^^^^^^^^^^^^^
> So we know that d->bLength is >= 10.
>
> > return false;
> > - len = d->bLength < sizeof(*d) + d->bNrInPins;
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> Len is 1 or 0.
>
> > + len = sizeof(*d) + d->bNrInPins;
> > if (d->bLength < len)
> ^^^^^^^^^^^^^^^^
>
> So this condition can't be false.
>
> > return false;
>
> But it just makes this return into dead code and we have a lot of dead
> code paths in the kernel so it doesn't make sense to generate a warning.
> ... I don't know if I have a solution.
>
> Maybe some day we will have a vim pluggin which will highlight all the
> dead paths and someone would notice that it that way.

That'd be awesome :) Of even a simple checker code that can run in
the git commit hook should suffice for careless maintainers like me.


thanks,

Takashi

\
 
 \ /
  Last update: 2019-10-28 15:46    [W:0.045 / U:0.100 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site