linux-kernel - re: rcu/nocb: Add bypass callback queueing, bug report

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <e89f5af3-dcf3-986f-828f-14e10cef9915@canonical.com>
Date:   Tue, 13 Aug 2019 13:34:02 +0100
From:   Colin Ian King <colin.king@...onical.com>
To:     "Paul E. McKenney" <paulmck@...ux.ibm.com>,
        Josh Triplett <josh@...htriplett.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        Lai Jiangshan <jiangshanlai@...il.com>,
        Joel Fernandes <joel@...lfernandes.org>, rcu@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org
Subject: re: rcu/nocb: Add bypass callback queueing, bug report

Hi,

Static analysis on linux-next today found an issue in the following commit:

commit 1afc4b18724f8f7b7a21fdf66cd43cc4a932812d
Author: Paul E. McKenney <paulmck@...ux.ibm.com>
Date:   Tue Jul 2 16:03:33 2019 -0700

    rcu/nocb: Add bypass callback queueing


The coverity report is as follows:

1783        // If we have advanced to a new jiffy, reset counts to allow
1784        // moving back from ->nocb_bypass to ->cblist.
1785        if (j == rdp->nocb_nobypass_last) {
1786                c = rdp->nocb_nobypass_count + 1;
1787        } else {
1788                WRITE_ONCE(rdp->nocb_nobypass_last, j);
1789                c = rdp->nocb_nobypass_count -
nocb_nobypass_lim_per_jiffy;
1790                if (c > nocb_nobypass_lim_per_jiffy)
1791                        c = nocb_nobypass_lim_per_jiffy;

CID 85141 (#1 of 1): Unsigned compared against 0
unsigned_compare: This less-than-zero comparison of an unsigned value is
never true. c < 0UL.

1792                else if (c < 0)
1793                        c = 0;

Variable c is an unsigned long so the c < 0 check is never true. I'm not
sure what the ramifications are if c is made a signed long instead, so
I'm not fixing this and reporting this issue.

Regards,

Colin