Messages in this thread | | | From | Dawson Engler <> | Subject | [CHECKER] 5 possible mis-uses of IS_ERR | Date | Wed, 21 Mar 2001 19:55:55 -0800 (PST) |
| |
Hi All,
as most people know, there are some number of routines in the kernel that pass back negative error codes as pointers, essentially doing the cast: return (void *)-ENOMEM;
These values are supposed to be checked with the routine IS_ERR: static inline long IS_ERR(const void *ptr) { return (unsigned long)ptr > (unsigned long)-1000L; }
For example: msg = load_msg(msgp->mtext, msgsz); if(IS_ERR(msg)) return PTR_ERR(msg);
A bad mistake is to check if such a routine failed by comparing the result to null. Some code in 2.3.99 did this:
/* ipc/shm.c:750 */ if (!(shp = seg_alloc(...))) return -ENOMEM; id = shm_addid(shp);
If seg_alloc did fail, it wouldn't return 0, but instead would give you back a bogus pointer with lots of high bits set. On some archtectures using it would let you trash the corresponding chunk of physical memory.
Anyway, we wrote a check to see that IS_ERR functions were handled consistently. The first pass sees which functions ever get checked using IS_ERR. The second pass makes sure these always get checked that way. It didn't find any bugs like the seg_alloc one, but it did find the opposite case, where code does an IS_ERR check on a function that actually returns NULL. (A problem, since IS_ERR(0) = 0)
However, these are in namei and reiserfs, so I'm not sure if I'm misunderstanding some subtle trick.
Dawson ------------------------------------------------------------------------ [BUG] __getname is just kmem_cache_alloc. returns 0 on failure so seems to cause a segfault.
/u2/engler/mc/oses/linux/2.4.1/fs/namei.c:1930:__vfs_follow_link: NOTE:DERIVE_IS_ERR:EXAMPLE: 'kmem_cache_alloc':1930
name = __getname(); if (IS_ERR(name)) goto fail_name; strcpy(name, nd->last.name); nd->last.name = name; return 0;
------------------------------------------------------------------------ [BUG] grab_cache page returns the result of __grab_cache_page which can return null. (doesn't seem to return an ERR_PTR)
/u2/engler/mc/oses/linux/2.4.1/fs/reiserfs/inode.c:480:convert_tail_for_hole: NOTE:DERIVE_IS_ERR:EXAMPLE: 'grab_cache_page':480
-------------------------------------------------------------------- [BUG] Ditto: block_prepare_write will deref page.
/u2/engler/mc/oses/linux/2.4.1/fs/reiserfs/inode.c:1490:grab_tail_page: NOTE:DERIVE_IS_ERR:EXAMPLE: 'grab_cache_page':1490
page = grab_cache_page(p_s_inode->i_mapping, index) ; error = PTR_ERR(page) ; if (IS_ERR(page)) { goto out ; } /* start within the page of the last block in the file */ start = (offset / blocksize) * blocksize ; error = block_prepare_write(page, start, offset, reiserfs_get_block_create_0) ;
-------------------------------------------------------------------- [BUG] Ditto: reiserfs_prepare_write will deref page. /u2/engler/mc/oses/linux/2.4.1/fs/reiserfs/ioctl.c:81:reiserfs_unpack: NOTE:DERIVE_IS_ERR:EXAMPLE: 'grab_cache_page':81
page = grab_cache_page(inode->i_mapping, index) ; retval = PTR_ERR(page) ; if (IS_ERR(page)) { goto out ; } retval = reiserfs_prepare_write(NULL, page, write_from, blocksize) ;
-------------------------------------------------------------------- [BUG] /u2/engler/mc/oses/linux/2.4.1/fs/buffer.c:1884:block_truncate_page: NOTE:DERIVE_IS_ERR:EXAMPLE: 'grab_cache_page':1884
page = grab_cache_page(mapping, index); err = PTR_ERR(page); if (IS_ERR(page)) goto out;
if (!page->buffers) create_empty_buffers(page, inode->i_dev, blocksize); ------------------------------------------------------------------------
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |