linux-kernel - Re: [PATCH 3.16] staging: usbip stub_rx fix static checker warning on unnecessary checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 11 Nov 2018 01:33:40 +0000
From:   Ben Hutchings <ben@...adent.org.uk>
To:     Shuah Khan <shuahkh@....samsung.com>, valentina.manea.m@...il.com,
        shuah@...nel.org, gregkh@...uxfoundation.org
Cc:     devel@...verdev.osuosl.org, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        bwh@...nel.org, dan.carpenter@...cle.com
Subject: Re: [PATCH 3.16] staging: usbip stub_rx fix static checker warning
 on unnecessary checks

On Mon, 2018-02-26 at 14:12 -0700, Shuah Khan wrote:
> Upstream commit 10c901209306
> ("usbip: stub_rx: fix static checker warning on unnecessary checks")
> 
> Back-port fix for static checker warning on unnecessary checks
> 
> smatch warnings:
> drivers/staging/usbip/stub_rx.c:360 get_pipe() warn: impossible
> condition '(pdu->u.cmd_submit.transfer_buffer_length > ((~0 >> 1))) =>
> (s32min-s32max > s32max)'
> drivers/staging/usbip/stub_rx.c:501 stub_recv_cmd_submit() warn: always
> true condition '(pdu->u.cmd_submit.transfer_buffer_length <= ((~0 >>
> 1))) => (s32min-s32max <= s32max)'

I've finally queued this up, thanks.

Ben.

> Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
> Signed-off-by: Shuah Khan <shuahkh@....samsung.com>
> ---
>  drivers/staging/usbip/stub_rx.c | 11 +----------
>  1 file changed, 1 insertion(+), 10 deletions(-)
> 
> diff --git a/drivers/staging/usbip/stub_rx.c b/drivers/staging/usbip/stub_rx.c
> index 35f59747122a..d8544ab9577b 100644
> --- a/drivers/staging/usbip/stub_rx.c
> +++ b/drivers/staging/usbip/stub_rx.c
> @@ -356,14 +356,6 @@ static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu)
>  
>  	epd = &ep->desc;
>  
> -	/* validate transfer_buffer_length */
> -	if (pdu->u.cmd_submit.transfer_buffer_length > INT_MAX) {
> -		dev_err(&sdev->udev->dev,
> -			"CMD_SUBMIT: -EMSGSIZE transfer_buffer_length %d\n",
> -			pdu->u.cmd_submit.transfer_buffer_length);
> -		return -1;
> -	}
> -
>  	if (usb_endpoint_xfer_control(epd)) {
>  		if (dir == USBIP_DIR_OUT)
>  			return usb_sndctrlpipe(udev, epnum);
> @@ -497,8 +489,7 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
>  	}
>  
>  	/* allocate urb transfer buffer, if needed */
> -	if (pdu->u.cmd_submit.transfer_buffer_length > 0 &&
> -	    pdu->u.cmd_submit.transfer_buffer_length <= INT_MAX) {
> +	if (pdu->u.cmd_submit.transfer_buffer_length > 0) {
>  		priv->urb->transfer_buffer =
>  			kzalloc(pdu->u.cmd_submit.transfer_buffer_length,
>  				GFP_KERNEL);
-- 
Ben Hutchings
Reality is just a crutch for people who can't handle science fiction.



Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)