lkml.org 
[lkml]   [2014]   [Jun]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 7/10] cciss: use safer test on the result of find_first_zero_bit


    On Wed, 4 Jun 2014, Jens Axboe wrote:

    > On 06/04/2014 08:51 AM, scameron@beardog.cce.hp.com wrote:
    > >> Find_first_zero_bit considers BITS_PER_LONG bits at a time, and thus may
    > >> return a larger number than the maximum position argument if that position
    > >> is not a multiple of BITS_PER_LONG.
    > >>
    > >> The semantic match that finds this problem is as follows:
    > >> (http://coccinelle.lip6.fr/)
    > >>
    > >> // <smpl>
    > >> @@
    > >> expression e1,e2,e3;
    > >> statement S1,S2;
    > >> @@
    > >>
    > >> e1 = find_first_zero_bit(e2,e3)
    > >> ...
    > >> if (e1
    > >> - ==
    > >> + >=
    > >> e3)
    > >> S1 else S2
    > >> // </smpl>
    > >>
    > >> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
    > >>
    > >> ---
    > >> drivers/block/cciss.c | 2 +-
    > >> 1 file changed, 1 insertion(+), 1 deletion(-)
    > >>
    > >> diff -u -p a/drivers/block/cciss.c b/drivers/block/cciss.c
    > >> --- a/drivers/block/cciss.c
    > >> +++ b/drivers/block/cciss.c
    > >> @@ -980,7 +980,7 @@ static CommandList_struct *cmd_alloc(ctl
    > >>
    > >> do {
    > >> i = find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds);
    > >> - if (i == h->nr_cmds)
    > >> + if (i >= h->nr_cmds)
    > >> return NULL;
    > >> } while (test_and_set_bit(i, h->cmd_pool_bits) != 0);
    > >> c = h->cmd_pool + i;
    > >
    > >
    > > Thanks. Ack.
    > >
    > > You can add
    > >
    > > Reviewed-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
    > >
    > > to this patch if you want.
    > >
    > > You might consider adding "Cc: stable@vger.kernel.org" into the
    > > sign-off area as well.
    >
    > There are two such instances in cciss.c, btw.

    Actually, there seem to be three, and I didn't find the other two because
    the assignment is inlined into the test. But the patch isn't needed
    anyway, because it turns out that the result never goes over the bound
    value.

    thanks,
    julia


    \
     
     \ /
      Last update: 2014-06-04 19:41    [W:3.543 / U:0.308 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site