Re: [PATCH] bcache: safeguard a dangerous addressing in closure_queue
From: Liang Chen <hidden>
Date: 2017-10-13 05:02:41
Also in:
lkml
On Fri, Oct 13, 2017 at 1:44 AM, Michael Lyle [off-list ref] wrote:
On 10/12/2017 07:37 AM, Liang Chen wrote:quoted
The use of the union reduces the size of closure struct by taking advantage of the current size of its members. The offset of func in work_struct equals the size of the first three members, so that work.work_func will just reference the forth member - fn. This is smart but dangerous. It can be broken if work_struct or the other structs get changed, and can be a bit difficult to debug. Signed-off-by: Liang Chen <redacted>So the objective here is to make sure that struct work_struct and the anonymous struct remain identical? I agree that's a potential problem for future maintenance. Could we use BUILD_BUG_ON with offsets and sizes to do the same, to get compile-time checking and avoid doing anything at runtime (I know the compiler can usually omit the BUG but better to be safe)? Otherwise a kernel that triggered this problem would compile, and it'd only be if someone actually used bcache that it would trigger. Mike
Yeah, the objective here is to make sure the offset of func and fn remains the same so cl->work.func will just reference cl->fn. Sure, BUILD_BUG_ON will do the work, and can capture the problem at compile time. Thanks for the reminding! I will submit another patch soon. Thanks, Liang