Re: [PATCH v2 1/2] ras: fix an off-by-one error in __find_elem()

From: Borislav Petkov
Date: Tue Apr 16 2019 - 17:46:41 EST

On Tue, Apr 16, 2019 at 02:33:50PM -0700, Cong Wang wrote:
> ce_arr.array[] is always within the range [0, ce_arr.n-1].
> However, the binary search code in __find_elem() uses ce_arr.n
> as the maximum index, which could lead to an off-by-one
> out-of-bound access right after the while loop. In this case,
> we should not even read it, just return -ENOKEY instead.
> Note, this could cause a kernel crash if ce_arr.n is exactly

"Could cause"?

I'm still waiting for a demonstration. You can build a case through
writing values in the debugfs nodes I pointed you at or even with a
patch ontop preparing the exact conditions for it to crash. And then
give me that "recipe" to trigger it here in a VM.



Good mailing practices for 400: avoid top-posting and trim the reply.