Re: [PATCH] tcmu: Fix possible overflow for memcpy address in iovec

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 2017年07月11日 17:17, Damien Le Moal wrote:
Xiubo,

On Tue, 2017-07-11 at 17:04 +0800, Xiubo Li wrote:
diff --git a/drivers/target/target_core_user.c
b/drivers/target/target_core_user.c
index 930800c..86a845a 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -437,7 +437,7 @@ static int scatter_data_area(struct tcmu_dev
*udev,
    			to_offset = get_block_offset_user(udev,
dbi,
    					block_remaining);
    			offset = DATA_BLOCK_SIZE -
block_remaining;
-			to = (void *)(unsigned long)to + offset;
+			to = (void *)((unsigned long)to + offset);
if (*iov_cnt != 0 &&
    			    to_offset == iov_tail(udev, *iov)) {
@@ -510,7 +510,7 @@ static void gather_data_area(struct tcmu_dev
*udev, struct tcmu_cmd *cmd,
    			copy_bytes = min_t(size_t, sg_remaining,
    					block_remaining);
    			offset = DATA_BLOCK_SIZE -
block_remaining;
-			from = (void *)(unsigned long)from +
offset;
+			from = (void *)((unsigned long)from +
offset);
    			tcmu_flush_dcache_range(from,
copy_bytes);
    			memcpy(to + sg->length - sg_remaining,
from,
    					copy_bytes);
I was just looking at this patch and about to try to see if it fixes my
problem... It cannot hurt. Trying...
Hi Damien,

Please test another patch, I think that one maybe fix this.
void * pointer arithmetic is OK and equivalent to unsigned long. So I do not
think this actually fixes anything and could be rewritten more simply as

Yes, it is. So I just discard this one.
I meant to sent the second patch(tcmu: Fix possbile memory leak when recalculating the cmd base size) but just for mistake by handy this one.

Actually (void *) == (char *) from the GUN C manual.

Thanks,
BRs


to += offset;
and

from += offset.

And that compiles without a warning and there are no complaints from sparse.

Cheers.








[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]

  Powered by Linux