[alsa-devel] KASAN: slab-out-of-bounds Read in build_audio_procunit

[Takashi Iwai]

On Mon, 28 Oct 2019 15:34:06 +0100,
Dan Carpenter wrote:
> 
> I wish that this could have been detected with static analysis...
> 
> On Tue, Oct 22, 2019 at 05:45:14PM +0200, Takashi Iwai wrote:
> > diff --git a/sound/usb/validate.c b/sound/usb/validate.c
> > index 3c8f73a0eb12..a5e584b60dcd 100644
> > --- a/sound/usb/validate.c
> > +++ b/sound/usb/validate.c
> > @@ -75,7 +75,7 @@ static bool validate_processing_unit(const void *p,
> >  
> >  	if (d->bLength < sizeof(*d))
>             ^^^^^^^^^^^^^^^^^^^^^^^
> So we know that d->bLength is >= 10.
> 
> >  		return false;
> > -	len = d->bLength < sizeof(*d) + d->bNrInPins;
>         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> Len is 1 or 0.
> 
> > +	len = sizeof(*d) + d->bNrInPins;
> >  	if (d->bLength < len)
>             ^^^^^^^^^^^^^^^^
> 
> So this condition can't be false.
> 
> >  		return false;
> 
> But it just makes this return into dead code and we have a lot of dead
> code paths in the kernel so it doesn't make sense to generate a warning.
> ...  I don't know if I have a solution.
> 
> Maybe some day we will have a vim pluggin which will highlight all the
> dead paths and someone would notice that it that way.

That'd be awesome :)  Of even a simple checker code that can run in
the git commit hook should suffice for careless maintainers like me.


thanks,

Takashi