netdev - Re: [Xen-devel] [PATCH 1/1] xen-netfront: do not cast grant table reference to signed short

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 31 Oct 2016 02:44:15 -0600
From:   "Jan Beulich" <JBeulich@...e.com>
To:     "Dongli Zhang" <dongli.zhang@...cle.com>
Cc:     <david.vrabel@...rix.com>, <xen-devel@...ts.xenproject.org>,
        <boris.ostrovsky@...cle.com>, "Juergen Gross" <JGross@...e.com>,
        <linux-kernel@...r.kernel.org>, <netdev@...r.kernel.org>
Subject: Re: [Xen-devel] [PATCH 1/1] xen-netfront: do not cast grant
 table reference to signed short

>>> On 31.10.16 at 09:28, <dongli.zhang@...cle.com> wrote:
>> >                  ref = gnttab_claim_grant_reference(&queue->gref_rx_head);
>> > -                BUG_ON((signed short)ref < 0);
>> > +                WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)ref));
> 
>> You really need to cast to plain (or signed) long here - casting to
>> unsigned long will work only in 32-bit configurations, as otherwise
>> you lose the sign of the value.
> 
> Seems the sign of value would not be lost since casting to unsigned long will
> use signed extension. Is my understanding wrong or did I miss anything?

ref being of type grant_ref_t, which is a typedef of uint32_t, I can't
see how the conversion to unsigned long would be using sign
extension. Did you look at the generated code? (If ref was of a signed
type, I don't think the original author would have found a need to cast
it to signed short.)

> I have verified this with both sample userspace helloworld program
> and a kernel module.

Are you saying you did see the warning trigger with a 64-bit kernel?
I'd be very surprised, but of course I may be overlooking something.

Jan