linux-kernel - Re: [PATCH] aio: Cleanup unnecessary test for nr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 22 Jun 2016 14:06:21 +0800
From:	Minfei Huang <mnghuan@...il.com>
To:	Al Viro <viro@...IV.linux.org.uk>
Cc:	bcrl@...ck.org, linux-fsdevel@...r.kernel.org, linux-aio@...ck.org,
	linux-kernel@...r.kernel.org, minfei.hmf@...baba-inc.com
Subject: Re: [PATCH] aio: Cleanup unnecessary test for nr_pages

On 06/20/16 at 03:17P, Al Viro wrote:
> On Mon, Jun 20, 2016 at 10:05:45PM +0800, Minfei Huang wrote:
> > Ping. Any comment is appreciate.
> > 
> > Thanks
> > Minfei
> > 
> > On 06/13/16 at 12:33P, Minfei Huang wrote:
> > > The variable nr_pages is always more than 1, because the size of
> > > structure aio_ring is bigger than 0. So remove unnecessary test for
> > > nr_page.
> 
> What this test really checks is that the value we'd put into nr_pages
> (PFN_UP(size)) is not greater than 2^31.  Whether it's redundant or not
> is a separate question - it very well might be, due to the code in
> ioctx_alloc() that caps nr_events, but that needs a proof.  In any case,
> the reasons you are offering in commit message are wrong - it's about
> size being too _large_, not too small.

Hmm. But there is a following test in function ioctx_alloc which is used
to limit the max of nr_events.

 713         /* Prevent overflows */
 714         if (nr_events > (0x10000000U / sizeof(struct io_event))) {
 715                 pr_debug("ENOMEM: nr_events too high\n");
 716                 return ERR_PTR(-EINVAL);
 717         }

So according to this test, we can make sure that nr_pages(PFN_UP(size))
cann't be greater than 2^31, and max to 2^28.

Thanks
Minfei