On Wed, Jul 13, 2022 at 11:17:17PM +0200,
Daniel Bristot de Oliveira <bristot@xxxxxxxxxx> wrote:
[...]
> +void put_task_monitor_slot(int slot)
> +{
> + lockdep_assert_held(&rv_interface_lock);
> +
> + if (slot < 0 || slot > RV_PER_TASK_MONITORS) {
slot is the array index that should be 0 here. The up bound is not bigger
than 0 because the element of array now is RV_PER_TASK_MONITORS.
So up bound check is 'slot > RV_PER_TASK_MONITORS-1'.
[...]
> +/*
> + * interface for enabling/disabling a monitor.
> + */
> +static ssize_t monitor_enable_write_data(struct file *filp, const char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + struct rv_monitor_def *mdef = filp->private_data;
> + int retval;
> + bool val;
> +
> + retval = kstrtobool_from_user(user_buf, count, &val);
> + if (retval)
> + return retval;
> +
> + retval = count;
> +
> + mutex_lock(&rv_interface_lock);
> +
> + if (val)
> + retval = enable_monitor(mdef);
> + else
> + retval = disable_monitor(mdef);
> +
> + mutex_unlock(&rv_interface_lock);
> +
> + return retval ? retval : count;
Feel that this can be written `return retval ? : count;`
[...]
> +static void *enabled_monitors_start(struct seq_file *m, loff_t *pos)
> +{
> + struct rv_monitor_def *m_def;
> + loff_t l;
> +
> + mutex_lock(&rv_interface_lock);
> +
> + if (list_empty(&rv_monitors_list))
> + return NULL;
> +
> + m_def = list_entry(&rv_monitors_list, struct rv_monitor_def, list);
> +
> + for (l = 0; l <= *pos; ) {
> + m_def = enabled_monitors_next(m, m_def, &l);
> + if (!m_def)
> + break;
Is this check is inversed. enabled_monitors_start() will stop at first
enabled monitor, then enabled_monitors_next() do loop to next. Check
like the above, enabled_monitors_start() will loop to the last monitor.
But I doubt myself I do not mention/see it. Sorry for these.
the check is:
if (m_def)
break;
[...]
> +static ssize_t
> +enabled_monitors_write(struct file *filp, const char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + char buff[MAX_RV_MONITOR_NAME_SIZE + 2];
> + struct rv_monitor_def *mdef;
> + int retval = -EINVAL;
> + bool enable = true;
> + char *ptr = buff;
> + int len;
> +
> + if (count < 1 || count > MAX_RV_MONITOR_NAME_SIZE + 2)
@count would not include '\0'. That the max val of @count is
MAX_RV_MONITOR_NAME_SIZE+1. So the up bound check of @count is
`count > MAX_RV_MONITOR_NAME_SIZE + 1`.
Thanks,
Tao
> + return -EINVAL;
> +
> + memset(buff, 0, sizeof(buff));
> +
> + retval = simple_write_to_buffer(buff, sizeof(buff) - 1, ppos, user_buf, count);
> + if (!retval)
> + return -EFAULT;
> +
> + ptr = strim(buff);
> +
> + if (ptr[0] == '!') {
> + enable = false;
> + ptr++;
> + }
> +
> + len = strlen(ptr);
> + if (!len)
> + return count;
> +
> + mutex_lock(&rv_interface_lock);
> +
> + retval = -EINVAL;
> +
> + list_for_each_entry(mdef, &rv_monitors_list, list) {
> + if (strcmp(ptr, mdef->monitor->name) != 0)
> + continue;
> +
> + /*
> + * Monitor found!
> + */
> + if (enable)
> + retval = enable_monitor(mdef);
> + else
> + retval = disable_monitor(mdef);
> +
> + if (!retval)
> + retval = count;
> +
> + break;
> + }
> +
> + mutex_unlock(&rv_interface_lock);
> + return retval;
> +}
|