linux-kernel - Re: [PATCH] posix-timer: don't call idr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 20 Feb 2013 13:37:01 -0800
From:	Tejun Heo <tj@...nel.org>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Sasha Levin <sasha.levin@...cle.com>, linux-kernel@...r.kernel.org,
	Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [PATCH] posix-timer: don't call idr_find() w/ negative ID

Hello, Andrew.

On Wed, Feb 20, 2013 at 01:23:00PM -0800, Andrew Morton wrote:
> > @@ -637,6 +637,9 @@ static struct k_itimer *__lock_timer(timer_t timer_id, unsigned long *flags)
> >  {
> >  	struct k_itimer *timr;
> >  
> > +	if ((int)timer_id < 0)
> > +		return NULL;
> > +
> >  	rcu_read_lock();
> >  	timr = idr_find(&posix_timers_id, (int)timer_id);
> >  	if (timr) {
> 
> This is a bit risky - if some arch defines timer_t to be a u64 then we
> will incorrectly treat 0x0000 0001 ffff ffff as a negative number. 
> (That's a lot of timers!)
> 
> A fancy way of avoiding this is
> 
> 	if (timer_id & ((typeof timer_id)1 << (sizeof(timer_id) - 1)))
> 
> (approximately ;))
> 
> But I think casting to (long) should be good enough?

Sans WARN_ON_ONCE(), the code would behave the same as before, which
in turn, from what I can tell, is the behavior the code intended to
implement before idr_alloc() conversion.

If timer_id is being allocated from idr, a valid id can never go over
INT_MAX and returning NULL for any ID above that is the correct
behavior, I think.  If timer_t is larger than int, both (int) and
(long) castings wouldn't be useful.  Both will miss (1LU << 33) + 1
and idr_find() will end up looking for 1.

If we want to be strict, we would have to do, I think,

	if ((unsigned long long)timer_t > INT_MAX)

hopefully with some comments.  That said, if I'm grepping it right,
all archs define timer_t as int, so maybe we're just being paranoid.

Thanks.

-- 
tejun
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/