Re: [PATCH] platform/x86: intel_pmc_core: fix out-of-bounds accesses on stack

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Jan 27, 2017 at 6:31 PM, Andrey Ryabinin
<aryabinin@xxxxxxxxxxxxx> wrote:
> On 01/27/2017 06:42 PM, Andy Shevchenko wrote:
>> On Thu, Jan 26, 2017 at 4:27 PM, Andrey Ryabinin
>> <aryabinin@xxxxxxxxxxxxx> wrote:
>>>  #if IS_ENABLED(CONFIG_DEBUG_FS)
>>> @@ -234,12 +230,8 @@ static const struct file_operations pmc_core_ppfear_ops = {
>>>  /* This function should return link status, 0 means ready */
>>>  static int pmc_core_mtpmc_link_status(void)
>>>  {
>>> -       struct pmc_dev *pmcdev = &pmc;
>>> -       u32 value;
>>> -
>>> -       value = pmc_core_reg_read(pmcdev, SPT_PMC_PM_STS_OFFSET);
>>> -       return test_bit(SPT_PMC_MSG_FULL_STS_BIT,
>>> -                       (unsigned long *)&value);
>>> +       u32 value = pmc_core_reg_read(&pmc, SPT_PMC_PM_STS_OFFSET);
>>> +       return value & (1U << SPT_PMC_MSG_FULL_STS_BIT);
>>>  }
>>
>> Thanks for the patch. IIRC I told (or may be forgot to tell) them
>> during internal review about the nasty casting.
>>
>> Btw, have you checked this will work in the same way, since test_bit()
>> is atomic?
>
> 'value' is a local variable, atomicity is pointless here.

Ah, indeed.

>> And if it's okay, why not to use BIT() macro?

> It just a matter of taste. I find open-coded variant easier to read.

Okay, what I'm about to do:

- switch to BIT() macro (it's already used by the driver)
- revert unrelated changes (piece of code where we get value)

and push it to testing.

Tell me if you have any objections.

-- 
With Best Regards,
Andy Shevchenko



[Index of Archives]     [Linux Kernel Development]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux