From: Jens Axboe <axboe@kernel.dk>
To: Dan Carpenter <dan.carpenter@oracle.com>, ajay.joshi@wdc.com
Cc: linux-block@vger.kernel.org
Subject: Re: [bug report] null_blk: return fixed zoned reads > write pointer
Date: Fri, 25 Oct 2019 14:25:45 -0600 [thread overview]
Message-ID: <658eaf70-beaf-240c-199a-e54a22d7095d@kernel.dk> (raw)
In-Reply-To: <20191023130623.GA3196@mwanda>
On 10/23/19 7:06 AM, Dan Carpenter wrote:
> Hello Ajay Joshi,
>
> The patch dd85b4922de1: "null_blk: return fixed zoned reads > write
> pointer" from Oct 17, 2019, leads to the following static checker
> warning:
>
> drivers/block/null_blk_zoned.c:91 null_zone_valid_read_len()
> warn: uncapped user index 'dev->zones[null_zone_no(dev, sector)]'
>
> drivers/block/null_blk_zoned.c
> 87 size_t null_zone_valid_read_len(struct nullb *nullb,
> 88 sector_t sector, unsigned int len)
> 89 {
> 90 struct nullb_device *dev = nullb->dev;
> 91 struct blk_zone *zone = &dev->zones[null_zone_no(dev, sector)];
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> 92 unsigned int nr_sectors = len >> SECTOR_SHIFT;
> 93
> 94 /* Read must be below the write pointer position */
> 95 if (zone->type == BLK_ZONE_TYPE_CONVENTIONAL ||
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> 96 sector + nr_sectors <= zone->wp)
> 97 return len;
> 98
> 99 if (sector > zone->wp)
> ^^^^^^^^^^^^^^^^^
>
> Smatch complains about "sector" being from the untrusted all the time
> and I kind of just ignore it these days. But here it looks like we're
> checking "sector" after we already used it so that seems very suspicious.
> It feels like "sector > zone->wp" should come at the very start of the
> function.
>
> 100 return 0;
> 101
> 102 return (zone->wp - sector) << SECTOR_SHIFT;
> 103 }
>
Ajay, please take a look at this and send in a patch if appropriate.
--
Jens Axboe
next prev parent reply other threads:[~2019-10-25 20:25 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-23 13:06 [bug report] null_blk: return fixed zoned reads > write pointer Dan Carpenter
2019-10-25 20:25 ` Jens Axboe [this message]
2019-10-28 4:40 ` Ajay Joshi
2019-10-28 6:13 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=658eaf70-beaf-240c-199a-e54a22d7095d@kernel.dk \
--to=axboe@kernel.dk \
--cc=ajay.joshi@wdc.com \
--cc=dan.carpenter@oracle.com \
--cc=linux-block@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).