linux-kernel - Re: [PATCH 2/3] gpu: drm: dead code elimination

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 18 Dec 2019 10:52:18 +0100
From:   Michel Dänzer <michel@...nzer.net>
To:     Pan Zhang <zhangpan26@...wei.com>, hushiyuan@...wei.com,
        alexander.deucher@....com, christian.koenig@....com,
        David1.Zhou@....com, airlied@...ux.ie, daniel@...ll.ch,
        ray.huang@....com, irmoy.das@....com, sam@...nborg.org
Cc:     dri-devel@...ts.freedesktop.org, amd-gfx@...ts.freedesktop.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/3] gpu: drm: dead code elimination

On 2019-12-18 4:50 a.m., Pan Zhang wrote:
> this set adds support for removal of gpu drm dead code.
> 
> patch2:
> `num_entries` is a data of unsigned type(compilers always treat as unsigned int) and SIZE_MAX == ~0,
> 
> so there is a impossible condition:
> '(num_entries > ((~0) - 56) / 72) => (max(0-u32) > 256204778801521549)'.

While this looks correct for 64-bit, where size_t is unsigned long, on
32-bit it's unsigned int, in which case this isn't dead code.


> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> index 85b0515..10a7f30 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> @@ -71,10 +71,6 @@ int amdgpu_bo_list_create(struct amdgpu_device *adev, struct drm_file *filp,
>  	unsigned i;
>  	int r;
>  
> -	if (num_entries > (SIZE_MAX - sizeof(struct amdgpu_bo_list))
> -				/ sizeof(struct amdgpu_bo_list_entry))
> -		return -EINVAL;
> -
>  	size = sizeof(struct amdgpu_bo_list);
>  	size += num_entries * sizeof(struct amdgpu_bo_list_entry);
>  	list = kvmalloc(size, GFP_KERNEL);
> 


-- 
Earthling Michel Dänzer               |               https://redhat.com
Libre software enthusiast             |             Mesa and X developer