linux-kernel - Re: [PATCH v3] smp: Fix a potential usage of stale nr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 27 Jul 2020 18:04:53 +0200
From:   Thomas Gleixner <tglx@...utronix.de>
To:     Ingo Molnar <mingo@...nel.org>,
        Muchun Song <songmuchun@...edance.com>
Cc:     peterz@...radead.org, bigeasy@...utronix.de, namit@...are.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3] smp: Fix a potential usage of stale nr_cpus

Ingo Molnar <mingo@...nel.org> writes:
>> -	get_option(&str, &nr_cpus);
>> +	if (get_option(&str, &nr_cpus) != 1)
>> +		return -EINVAL;
>> +
>>  	if (nr_cpus > 0 && nr_cpus < nr_cpu_ids)
>>  		nr_cpu_ids = nr_cpus;
>> +	else
>> +		return -EINVAL;
>
> Exactly what does 'not valid' mean, and why doesn't get_option() 
> return -EINVAL in that case?

What's unclear about invalid? If you specify nr_cpus=-1 or
nr_cpus=2000000 the its obviously invalid.

How should get_option() know that this is invalid? get_option() is a
number parser and does not know about any restrictions on the parsed
value obviously.

get_option() returns string parsing information:

       0 -> not integer found
       1 -> integer found, no trailing comma or hyphen
       2 -> integer found and trailing comma
       3 -> integer found and traling hyphen (range parsing)

And that's what is checked in if (get_option() != 1), i.e. anything else
than a plain integer is invalid for this command line option.

Thanks,

        tglx