Re: KASAN: slab-out-of-bounds Read in build_audio_procunit

[Dan Carpenter]

I wish that this could have been detected with static analysis...

On Tue, Oct 22, 2019 at 05:45:14PM +0200, Takashi Iwai wrote:
> diff --git a/sound/usb/validate.c b/sound/usb/validate.c
> index 3c8f73a0eb12..a5e584b60dcd 100644
> --- a/sound/usb/validate.c
> +++ b/sound/usb/validate.c
> @@ -75,7 +75,7 @@ static bool validate_processing_unit(const void *p,
>  
>  	if (d->bLength < sizeof(*d))
            ^^^^^^^^^^^^^^^^^^^^^^^
So we know that d->bLength is >= 10.

>  		return false;
> -	len = d->bLength < sizeof(*d) + d->bNrInPins;
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Len is 1 or 0.

> +	len = sizeof(*d) + d->bNrInPins;
>  	if (d->bLength < len)
            ^^^^^^^^^^^^^^^^

So this condition can't be false.

>  		return false;

But it just makes this return into dead code and we have a lot of dead
code paths in the kernel so it doesn't make sense to generate a warning.
...  I don't know if I have a solution.

Maybe some day we will have a vim pluggin which will highlight all the
dead paths and someone would notice that it that way.

regards,
dan carpenter