Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1221218 > unrolled thread
| Started by | Wang Long <long.wanglong@huawei.com> |
|---|---|
| First post | 2015-09-09 06:10 +0200 |
| Last post | 2015-09-09 12:30 +0200 |
| Articles | 5 — 4 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
[PATCH 2/2] kasan: Fix a type conversion error Wang Long <long.wanglong@huawei.com> - 2015-09-09 06:10 +0200
Re: [PATCH 2/2] kasan: Fix a type conversion error Vladimir Murzin <vladimir.murzin@arm.com> - 2015-09-09 11:10 +0200
Re: [PATCH 2/2] kasan: Fix a type conversion error "long.wanglong" <long.wanglong@huawei.com> - 2015-09-09 11:40 +0200
Re: [PATCH 2/2] kasan: Fix a type conversion error Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2015-09-09 11:50 +0200
Re: [PATCH 2/2] kasan: Fix a type conversion error "long.wanglong" <long.wanglong@huawei.com> - 2015-09-09 12:30 +0200
| From | Wang Long <long.wanglong@huawei.com> |
|---|---|
| Date | 2015-09-09 06:10 +0200 |
| Subject | [PATCH 2/2] kasan: Fix a type conversion error |
| Message-ID | <q6ERP-8s-5@gated-at.bofh.it> |
The current KASAN code can find the following out-of-bounds bugs: char *ptr; ptr = kmalloc(8, GFP_KERNEL); memset(ptr+7, 0, 2); the cause of the problem is the type conversion error in *memory_is_poisoned_n* function. So this patch fix that. Signed-off-by: Wang Long <long.wanglong@huawei.com> --- mm/kasan/kasan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c index 7b28e9c..5d65d06 100644 --- a/mm/kasan/kasan.c +++ b/mm/kasan/kasan.c @@ -204,7 +204,7 @@ static __always_inline bool memory_is_poisoned_n(unsigned long addr, s8 *last_shadow = (s8 *)kasan_mem_to_shadow((void *)last_byte); if (unlikely(ret != (unsigned long)last_shadow || - ((last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) + ((long)(last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) return true; } return false; -- 1.8.3.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [next] | [standalone]
| From | Vladimir Murzin <vladimir.murzin@arm.com> |
|---|---|
| Date | 2015-09-09 11:10 +0200 |
| Message-ID | <q6Jy9-6ZC-11@gated-at.bofh.it> |
| In reply to | #1221218 |
On 09/09/15 04:59, Wang Long wrote: > The current KASAN code can find the following out-of-bounds Should it be "cannot"? Vladimir > bugs: > char *ptr; > ptr = kmalloc(8, GFP_KERNEL); > memset(ptr+7, 0, 2); > > the cause of the problem is the type conversion error in > *memory_is_poisoned_n* function. So this patch fix that. > > Signed-off-by: Wang Long <long.wanglong@huawei.com> > --- > mm/kasan/kasan.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c > index 7b28e9c..5d65d06 100644 > --- a/mm/kasan/kasan.c > +++ b/mm/kasan/kasan.c > @@ -204,7 +204,7 @@ static __always_inline bool memory_is_poisoned_n(unsigned long addr, > s8 *last_shadow = (s8 *)kasan_mem_to_shadow((void *)last_byte); > > if (unlikely(ret != (unsigned long)last_shadow || > - ((last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) > + ((long)(last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) > return true; > } > return false; > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | "long.wanglong" <long.wanglong@huawei.com> |
|---|---|
| Date | 2015-09-09 11:40 +0200 |
| Message-ID | <q6K1b-7xZ-5@gated-at.bofh.it> |
| In reply to | #1221317 |
On 2015/9/9 17:01, Vladimir Murzin wrote: > On 09/09/15 04:59, Wang Long wrote: >> The current KASAN code can find the following out-of-bounds > > Should it be "cannot"? > > Vladimir > sorry for that mistake, it should be "cannot". >> bugs: >> char *ptr; >> ptr = kmalloc(8, GFP_KERNEL); >> memset(ptr+7, 0, 2); >> >> the cause of the problem is the type conversion error in >> *memory_is_poisoned_n* function. So this patch fix that. >> >> Signed-off-by: Wang Long <long.wanglong@huawei.com> >> --- >> mm/kasan/kasan.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c >> index 7b28e9c..5d65d06 100644 >> --- a/mm/kasan/kasan.c >> +++ b/mm/kasan/kasan.c >> @@ -204,7 +204,7 @@ static __always_inline bool memory_is_poisoned_n(unsigned long addr, >> s8 *last_shadow = (s8 *)kasan_mem_to_shadow((void *)last_byte); >> >> if (unlikely(ret != (unsigned long)last_shadow || >> - ((last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) >> + ((long)(last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) >> return true; >> } >> return false; >> > > > . > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Andrey Ryabinin <ryabinin.a.a@gmail.com> |
|---|---|
| Date | 2015-09-09 11:50 +0200 |
| Message-ID | <q6KaS-7Lb-23@gated-at.bofh.it> |
| In reply to | #1221218 |
2015-09-09 6:59 GMT+03:00 Wang Long <long.wanglong@huawei.com>: > The current KASAN code can find the following out-of-bounds > bugs: > char *ptr; > ptr = kmalloc(8, GFP_KERNEL); > memset(ptr+7, 0, 2); > > the cause of the problem is the type conversion error in > *memory_is_poisoned_n* function. So this patch fix that. > > Signed-off-by: Wang Long <long.wanglong@huawei.com> > --- > mm/kasan/kasan.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c > index 7b28e9c..5d65d06 100644 > --- a/mm/kasan/kasan.c > +++ b/mm/kasan/kasan.c > @@ -204,7 +204,7 @@ static __always_inline bool memory_is_poisoned_n(unsigned long addr, > s8 *last_shadow = (s8 *)kasan_mem_to_shadow((void *)last_byte); > > if (unlikely(ret != (unsigned long)last_shadow || > - ((last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) > + ((long)(last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) Is there any problem if we just define last_byte as 'long' instead of 'unsigned long' ? > return true; > } > return false; > -- > 1.8.3.4 > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | "long.wanglong" <long.wanglong@huawei.com> |
|---|---|
| Date | 2015-09-09 12:30 +0200 |
| Message-ID | <q6KNB-i6-41@gated-at.bofh.it> |
| In reply to | #1221347 |
On 2015/9/9 17:40, Andrey Ryabinin wrote: > 2015-09-09 6:59 GMT+03:00 Wang Long <long.wanglong@huawei.com>: >> The current KASAN code can find the following out-of-bounds >> bugs: >> char *ptr; >> ptr = kmalloc(8, GFP_KERNEL); >> memset(ptr+7, 0, 2); >> >> the cause of the problem is the type conversion error in >> *memory_is_poisoned_n* function. So this patch fix that. >> >> Signed-off-by: Wang Long <long.wanglong@huawei.com> >> --- >> mm/kasan/kasan.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c >> index 7b28e9c..5d65d06 100644 >> --- a/mm/kasan/kasan.c >> +++ b/mm/kasan/kasan.c >> @@ -204,7 +204,7 @@ static __always_inline bool memory_is_poisoned_n(unsigned long addr, >> s8 *last_shadow = (s8 *)kasan_mem_to_shadow((void *)last_byte); >> >> if (unlikely(ret != (unsigned long)last_shadow || >> - ((last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) >> + ((long)(last_byte & KASAN_SHADOW_MASK) >= *last_shadow))) > > Is there any problem if we just define last_byte as 'long' instead of > 'unsigned long' ? yes, I think it is not OK, because on my test, if we define last_byte as 'long' instead of 'unsigned long', the bug we talk about can not be found. > >> return true; >> } >> return false; >> -- >> 1.8.3.4 >> > > . > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web