linux-kernel - [PATCH] kernel/range: Fix clean_sort

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4CD48BDA.9020102@ispras.ru>
Date:	Sat, 06 Nov 2010 01:57:30 +0300
From:	Alexey Khoroshilov <khoroshilov@...ras.ru>
To:	Yinghai Lu <yinghai@...nel.org>, "H. Peter Anvin" <hpa@...or.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Geert Uytterhoeven <geert@...ux-m68k.org>,
	linux-kernel@...r.kernel.org
Subject: [PATCH] kernel/range: Fix clean_sort_range for the case of full array

clean_sort_range() should return a number of nonempty elements of range 
array, but if the array is full clean_sort_range() returns 0.

The problem is that the number of nonempty elements is evaluated by 
finding the first empty element of the array. If there is no such 
element it returns an initial value of local variable nr_range that is zero.

The fix is trivial: it changes initial value of nr_range to size of the 
array.

The bug can lead to loss of information regarding all ranges, since 
typically returned value of clean_sort_range() is considered as an 
actual number of ranges in the array after a series of add/subtract 
operations.

Found by Analytical Verification project of Linux Verification Center 
(linuxtesting.org), thanks to Alexander Kolosov.

Signed-off-by: Alexey Khoroshilov <khoroshilov@...ras.ru>
---

diff --git a/kernel/range.c b/kernel/range.c
index 471b66a..37fa9b9 100644
--- a/kernel/range.c
+++ b/kernel/range.c
@@ -119,7 +119,7 @@ static int cmp_range(const void *x1, const void *x2)

  int clean_sort_range(struct range *range, int az)
  {
-       int i, j, k = az - 1, nr_range = 0;
+       int i, j, k = az - 1, nr_range = az;

         for (i = 0; i < k; i++) {
                 if (range[i].end)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/