Re: [PATCH v8 37/43] dyndbg: harden classmap and descriptor validation
From: sashiko-bot@kernel.org
Date: 2026-09-05 18:29:46
Also in:
dri-devel
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] Off-by-one error in runtime classmap offset validation restricts the maximum valid class ID. -- commit 9fc4489f7afee86c427de8b09e6f38f827d4fc24 Author: Jim Cromie [off-list ref] dyndbg: harden classmap and descriptor validation This commit improves classmap and descriptor validation by mirroring compile-time limits of _DEFINE and adding run-time overlap checks for _USEd classmaps. It scans module descriptors at load time to warn about missing class_ids instead of waiting for a user query.
quoted hunk ↗ jump to hunk
diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c index a5d813ad323a1..b7ccf471b5efe 100644 --- a/lib/dynamic_debug.c +++ b/lib/dynamic_debug.c
[ ... ]
quoted hunk ↗ jump to hunk
@@ -1524,10 +1543,47 @@ static int ddebug_add_module(struct _ddebug_info *di) dd_set_module_subrange(i, cm, &dt->info, maps); dd_set_module_subrange(i, cli, &dt->info, users); - /* insure 2+ classmaps share the per-module 0..62 class_id space */ + /* validate the per-module shared 0..62 class_id space */ for_subvec(i, cm, &dt->info, maps) if (ddebug_class_range_overlap(cm, &reserved_ids)) - goto cleanup; + err = -EINVAL; + + for_subvec(i, cli, &dt->info, users) { + cm = cli->map; + if (!cm) { + pr_err("module %s: classmap not found for user\n", di->mod_name); + err = -EINVAL; + continue; + } + + if (cm->base + cm->length + cli->offset >= _DPRINTK_CLASS_DFLT) {
[Severity: Medium] Does this condition have an off-by-one error that restricts the maximum valid class ID? The _DPRINTK_CLASS_DFLT macro is defined as 63, which means valid class IDs range from 0 to 62. The maximum assigned class ID for a given map and offset is base + length + offset - 1. If base + length + offset == 63, the maximum assigned class ID is exactly 62, which should be valid. Because the code checks if the sum is >= _DPRINTK_CLASS_DFLT, a valid boundary case of 63 is erroneously flagged as an error. This shrinks the valid class ID space to 0..61 instead of the expected 0..62.
+ pr_err("module %s: base:%d + classes.len:%d + cli.offset:%d must be < %d\n",
+ di->mod_name, cm->base, cm->length,
+ cli->offset, _DPRINTK_CLASS_DFLT);
+ err = -EINVAL;
+ continue;
+ }
+
+ if (ddebug_class_user_overlap(cli, &reserved_ids))
+ err = -EINVAL;
+ }-- Sashiko AI review · https://sashiko.dev/#/patchset/20260905-dd-cmap-part2-clean-v8-0-a4cc0674f6fd@gmail.com?part=37