On Fri, Jul 15, 2022 at 01:47:28PM +0200, Daniel Bristot de Oliveira wrote: > On 7/14/22 09:46, Tao Zhou wrote: > > On Wed, Jul 13, 2022 at 11:17:17PM +0200, > > Daniel Bristot de Oliveira <bristot@xxxxxxxxxx> wrote: > > > > [...] > > > >> +void put_task_monitor_slot(int slot) > >> +{ > >> + lockdep_assert_held(&rv_interface_lock); > >> + > >> + if (slot < 0 || slot > RV_PER_TASK_MONITORS) { > > > > slot is the array index that should be 0 here. The up bound is not bigger > > than 0 because the element of array now is RV_PER_TASK_MONITORS. > > > > So up bound check is 'slot > RV_PER_TASK_MONITORS-1'. > > fixed! (slot >= RV...) > > > [...] > > > >> +/* > >> + * interface for enabling/disabling a monitor. > >> + */ > >> +static ssize_t monitor_enable_write_data(struct file *filp, const char __user *user_buf, > >> + size_t count, loff_t *ppos) > >> +{ > >> + struct rv_monitor_def *mdef = filp->private_data; > >> + int retval; > >> + bool val; > >> + > >> + retval = kstrtobool_from_user(user_buf, count, &val); > >> + if (retval) > >> + return retval; > >> + > >> + retval = count; > >> + > >> + mutex_lock(&rv_interface_lock); > >> + > >> + if (val) > >> + retval = enable_monitor(mdef); > >> + else > >> + retval = disable_monitor(mdef); > >> + > >> + mutex_unlock(&rv_interface_lock); > >> + > >> + return retval ? retval : count; > > > > Feel that this can be written `return retval ? : count;` > > > why not... > > > [...] > > > >> +static void *enabled_monitors_start(struct seq_file *m, loff_t *pos) > >> +{ > >> + struct rv_monitor_def *m_def; > >> + loff_t l; > >> + > >> + mutex_lock(&rv_interface_lock); > >> + > >> + if (list_empty(&rv_monitors_list)) > >> + return NULL; > >> + > >> + m_def = list_entry(&rv_monitors_list, struct rv_monitor_def, list); > >> + > >> + for (l = 0; l <= *pos; ) { > >> + m_def = enabled_monitors_next(m, m_def, &l); > >> + if (!m_def) > >> + break; > > > > Is this check is inversed. enabled_monitors_start() will stop at first > > enabled monitor, then enabled_monitors_next() do loop to next. Check > > like the above, enabled_monitors_start() will loop to the last monitor. > > But I doubt myself I do not mention/see it. Sorry for these. > > > > the check is: > > > > if (m_def) > > break; > > > > [...] > > > see kernel/trace/trace_events.c:s_start... I presumed @l changed in function enabled_monitors_next() will impack on the @*pos of enabled_monitors_start(). But it's not. @l is increased by 1 in enabled_monitors_next() and is used to check with @*pos passed as parameter argument of enabled_monitors_start(). Absolutely I lost here.. Thanks. > >> +static ssize_t > >> +enabled_monitors_write(struct file *filp, const char __user *user_buf, > >> + size_t count, loff_t *ppos) > >> +{ > >> + char buff[MAX_RV_MONITOR_NAME_SIZE + 2]; > >> + struct rv_monitor_def *mdef; > >> + int retval = -EINVAL; > >> + bool enable = true; > >> + char *ptr = buff; > >> + int len; > >> + > >> + if (count < 1 || count > MAX_RV_MONITOR_NAME_SIZE + 2) > > > > @count would not include '\0'. That the max val of @count is > > MAX_RV_MONITOR_NAME_SIZE+1. So the up bound check of @count is > > `count > MAX_RV_MONITOR_NAME_SIZE + 1`. > > Fixed for v6... > > -- Daniel