Messages in this thread | | | Date | Wed, 20 Feb 2013 14:05:51 -0800 | From | Andrew Morton <> | Subject | Re: [PATCH] posix-timer: don't call idr_find() w/ negative ID |
| |
On Wed, 20 Feb 2013 13:37:01 -0800 Tejun Heo <tj@kernel.org> wrote:
> Hello, Andrew. > > On Wed, Feb 20, 2013 at 01:23:00PM -0800, Andrew Morton wrote: > > > @@ -637,6 +637,9 @@ static struct k_itimer *__lock_timer(timer_t timer_id, unsigned long *flags) > > > { > > > struct k_itimer *timr; > > > > > > + if ((int)timer_id < 0) > > > + return NULL; > > > + > > > rcu_read_lock(); > > > timr = idr_find(&posix_timers_id, (int)timer_id); > > > if (timr) { > > > > This is a bit risky - if some arch defines timer_t to be a u64 then we > > will incorrectly treat 0x0000 0001 ffff ffff as a negative number. > > (That's a lot of timers!) > > > > A fancy way of avoiding this is > > > > if (timer_id & ((typeof timer_id)1 << (sizeof(timer_id) - 1))) > > > > (approximately ;)) > > > > But I think casting to (long) should be good enough? > > Sans WARN_ON_ONCE(), the code would behave the same as before, which > in turn, from what I can tell, is the behavior the code intended to > implement before idr_alloc() conversion. > > If timer_id is being allocated from idr, a valid id can never go over > INT_MAX and returning NULL for any ID above that is the correct > behavior, I think. If timer_t is larger than int, both (int) and > (long) castings wouldn't be useful. Both will miss (1LU << 33) + 1 > and idr_find() will end up looking for 1. > > If we want to be strict, we would have to do, I think, > > if ((unsigned long long)timer_t > INT_MAX) > > hopefully with some comments. That said, if I'm grepping it right, > all archs define timer_t as int, so maybe we're just being paranoid. >
Sure, it's unlikely to cause a problem in practice. Maybe five years from now, after idr has been cleaned up and switched to 64-bit, we've left a little hand grenade for someone. It would be good to future-safe it in some fashion.
I wonder if we should add some generic facility to handle this:
/* * Query whether an unsigned type is `negative' when we don't know its size */ #define msb_is_set(v) { implementation goes here ;) }
Maybe not justified, dunno...
| |