Messages in this thread | | | Date | Mon, 28 Oct 2019 17:34:06 +0300 | From | Dan Carpenter <> | Subject | Re: KASAN: slab-out-of-bounds Read in build_audio_procunit |
| |
I wish that this could have been detected with static analysis...
On Tue, Oct 22, 2019 at 05:45:14PM +0200, Takashi Iwai wrote: > diff --git a/sound/usb/validate.c b/sound/usb/validate.c > index 3c8f73a0eb12..a5e584b60dcd 100644 > --- a/sound/usb/validate.c > +++ b/sound/usb/validate.c > @@ -75,7 +75,7 @@ static bool validate_processing_unit(const void *p, > > if (d->bLength < sizeof(*d)) ^^^^^^^^^^^^^^^^^^^^^^^ So we know that d->bLength is >= 10.
> return false; > - len = d->bLength < sizeof(*d) + d->bNrInPins; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Len is 1 or 0.
> + len = sizeof(*d) + d->bNrInPins; > if (d->bLength < len) ^^^^^^^^^^^^^^^^
So this condition can't be false.
> return false;
But it just makes this return into dead code and we have a lot of dead code paths in the kernel so it doesn't make sense to generate a warning. ... I don't know if I have a solution.
Maybe some day we will have a vim pluggin which will highlight all the dead paths and someone would notice that it that way.
regards, dan carpenter
| |