Thread (3 messages) 3 messages, 2 authors, 2017-10-13

Re: [PATCH] bcache: safeguard a dangerous addressing in closure_queue

From: Liang Chen <hidden>
Date: 2017-10-13 05:02:41
Also in: lkml

On Fri, Oct 13, 2017 at 1:44 AM, Michael Lyle [off-list ref] wrote:
On 10/12/2017 07:37 AM, Liang Chen wrote:
quoted
The use of the union reduces the size of closure struct by taking advantage
of the current size of its members. The offset of func in work_struct equals
the size of the first three members, so that work.work_func will just
reference the forth member - fn.

This is smart but dangerous. It can be broken if work_struct or the other
structs get changed, and can be a bit difficult to debug.

Signed-off-by: Liang Chen <redacted>
So the objective here is to make sure that struct work_struct and the
anonymous struct remain identical?  I agree that's a potential problem
for future maintenance.

Could we use BUILD_BUG_ON with offsets and sizes to do the same, to get
compile-time checking and avoid doing anything at runtime (I know the
compiler can usually omit the BUG but better to be safe)?  Otherwise a
kernel that triggered this problem would compile, and it'd only be if
someone actually used bcache that it would trigger.

Mike
Yeah, the objective here is to make sure the offset of func and fn remains the
same so cl->work.func will just reference cl->fn.

Sure, BUILD_BUG_ON will do the work, and can capture the problem at compile
time. Thanks for the reminding! I will submit another patch soon.

Thanks,
Liang
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help