linux-kernel - Re: [PATCH 2/3] gpu: drm: dead code elimination

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 18 Dec 2019 10:52:06 +0100
From:   Christian König <christian.koenig@....com>
To:     Pan Zhang <zhangpan26@...wei.com>, hushiyuan@...wei.com,
        alexander.deucher@....com, David1.Zhou@....com, airlied@...ux.ie,
        daniel@...ll.ch, ray.huang@....com, irmoy.das@....com,
        sam@...nborg.org
Cc:     amd-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/3] gpu: drm: dead code elimination

Am 18.12.19 um 04:50 schrieb Pan Zhang:
> this set adds support for removal of gpu drm dead code.
>
> patch2:
> `num_entries` is a data of unsigned type(compilers always treat as unsigned int) and SIZE_MAX == ~0,
>
> so there is a impossible condition:
> '(num_entries > ((~0) - 56) / 72) => (max(0-u32) > 256204778801521549)'.

NAK, that calculation is not correct on 32-bit systems.

Christian.

>
> Signed-off-by: Pan Zhang <zhangpan26@...wei.com>
> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 4 ----
>   1 file changed, 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> index 85b0515..10a7f30 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
> @@ -71,10 +71,6 @@ int amdgpu_bo_list_create(struct amdgpu_device *adev, struct drm_file *filp,
>   	unsigned i;
>   	int r;
>   
> -	if (num_entries > (SIZE_MAX - sizeof(struct amdgpu_bo_list))
> -				/ sizeof(struct amdgpu_bo_list_entry))
> -		return -EINVAL;
> -
>   	size = sizeof(struct amdgpu_bo_list);
>   	size += num_entries * sizeof(struct amdgpu_bo_list_entry);
>   	list = kvmalloc(size, GFP_KERNEL);