question about blkio_get_stat()
Hi Divyesh,
Smatch complains that we go outside the array in blkio_get_stat().
block/blk-cgroup.c
731 if (type == BLKIO_STAT_DEQUEUE)
^^^^^^^^^^^^^^^^^^^^^^^^^^
BLKIO_STAT_DEQUEUE is 9.
732 return blkio_fill_stat(key_str, MAX_KEY_LEN - 1,
733 blkg->stats.dequeue, cb, dev);
734 #endif
735
736 for (sub_type = BLKIO_STAT_READ; sub_type < BLKIO_STAT_TOTAL;
737 sub_type++) {
738 blkio_get_key_name(sub_type, dev, key_str, MAX_KEY_LEN, false);
739 cb->fill(cb, key_str, blkg->stats.stat_arr[type][sub_type]);
^^^^^^^^^^^^^^^^^^^^This array only has 4 elements and if "type" is 9 we're past the end of array.
740 }
It's odd that Smatch only started complaining about this now, but this code has been there for years. I'm puzzled by what changed. Sorry if there is something obvious I have missed.
regards,
dan carpenter
Hi,
Quoted 16 lines · Dan Carpenter
Smatch complains that we go outside the array in
blkio_get_stat().
block/blk-cgroup.c
731 if (type ==BLKIO_STAT_DEQUEUE)^^^^^^^^^^^^^^^^^^^^^^^^^^
BLKIO_STAT_DEQUEUEis 9.732 return blkio_fill_stat(key_str, MAX_KEY_LEN - 1, 733 blkg->stats.dequeue, cb, dev); 734 #endif 735 736 for (sub_type = BLKIO_STAT_READ; sub_type < BLKIO_STAT_TOTAL; 737 sub_type++) { 738 blkio_get_key_name(sub_type, dev, key_str, MAX_KEY_LEN, false); 739 cb->fill(cb, key_str, blkg->stats.stat_arr[type][sub_type]); ^^^^^^^^^^^^^^^^^^^^
Quoted 8 lines
This array only has 4 elements and if "type" is 9 we're past the end of array.
740 }It's odd that Smatch only started complaining about this now, but this code has been there for years. I'm puzzled by what changed. Sorry if there is something obvious I have missed.
It seems that BLKIO_STAT_... values larger than BLK_IO_STAT_QUEUE are
defined only if CONFIG_DEBUG_BLK_CGROUP is defined. And in that case they are also handled by blkio_get_stat() in a special way so we never get to computing blkg->stats.stat_arr[type][sub_type]. So everything seems fine.
Honza
Signature · 2 lines
Jan Kara <[email protected]> SUSE Labs, CR