hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

flex_array: convert element_nr formals to unsigned 

It's problematic to allow signed element_nr's or total's to be passed as
part of the flex array API.

flex_array_alloc() allows total_nr_elements to be set to a negative
quantity, which is obviously erroneous.

flex_array_get() and flex_array_put() allows negative array indices in
dereferencing an array part, which could address memory mapped before
struct flex_array.

The fix is to convert all existing element_nr formals to be qualified as
unsigned.  Existing checks to compare it to total_nr_elements or the max
array size based on element_size need not be changed.

Signed-off-by: David Rientjes <rientjes@google.com>
Cc: Dave Hansen <dave@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
David Rientjes 2009-08-26 14:29:22 -07:00 committed by Linus Torvalds
parent 8e7ee27095
commit b62e408c05
2 changed files with 19 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
include/linux/flex_array.h
View File

@ -36,12 +36,14 @@ struct flex_array {
.total_nr_elements = (total), \ .total_nr_elements = (total), \
} } } } } }
struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags); struct flex_array *flex_array_alloc(int element_size, unsigned int total,
int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags); gfp_t flags);
int flex_array_prealloc(struct flex_array *fa, unsigned int start,
unsigned int end, gfp_t flags);
void flex_array_free(struct flex_array *fa); void flex_array_free(struct flex_array *fa);
void flex_array_free_parts(struct flex_array *fa); void flex_array_free_parts(struct flex_array *fa);
int flex_array_put(struct flex_array *fa, int element_nr, void *src, int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,
gfp_t flags); gfp_t flags);
void *flex_array_get(struct flex_array *fa, int element_nr); void *flex_array_get(struct flex_array *fa, unsigned int element_nr);
#endif /* _FLEX_ARRAY_H */ #endif /* _FLEX_ARRAY_H */

24
lib/flex_array.c
View File

@ -99,7 +99,8 @@ static inline int elements_fit_in_base(struct flex_array *fa)
* capacity in the base structure. Also note that no effort is made * capacity in the base structure. Also note that no effort is made
* to efficiently pack objects across page boundaries. * to efficiently pack objects across page boundaries.
*/ */
struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags) struct flex_array *flex_array_alloc(int element_size, unsigned int total,
gfp_t flags)
{ {
struct flex_array *ret; struct flex_array *ret;
int max_size = nr_base_part_ptrs() * __elements_per_part(element_size); int max_size = nr_base_part_ptrs() * __elements_per_part(element_size);
@ -115,7 +116,8 @@ struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags)
return ret; return ret;
} }
static int fa_element_to_part_nr(struct flex_array *fa, int element_nr) static int fa_element_to_part_nr(struct flex_array *fa,
unsigned int element_nr)
{ {
return element_nr / __elements_per_part(fa->element_size); return element_nr / __elements_per_part(fa->element_size);
} }
@ -143,14 +145,12 @@ void flex_array_free(struct flex_array *fa)
kfree(fa); kfree(fa);
} }
static int fa_index_inside_part(struct flex_array *fa, int element_nr) static unsigned int index_inside_part(struct flex_array *fa,
unsigned int element_nr)
{ {
return element_nr % __elements_per_part(fa->element_size); unsigned int part_offset;
}
static int index_inside_part(struct flex_array *fa, int element_nr) part_offset = element_nr % __elements_per_part(fa->element_size);
{
int part_offset = fa_index_inside_part(fa, element_nr);
return part_offset * fa->element_size; return part_offset * fa->element_size;
} }
@ -185,7 +185,8 @@ __fa_get_part(struct flex_array *fa, int part_nr, gfp_t flags)
* *
* Locking must be provided by the caller. * Locking must be provided by the caller.
*/ */
int flex_array_put(struct flex_array *fa, int element_nr, void *src, gfp_t flags) int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,
gfp_t flags)
{ {
int part_nr = fa_element_to_part_nr(fa, element_nr); int part_nr = fa_element_to_part_nr(fa, element_nr);
struct flex_array_part *part; struct flex_array_part *part;
@ -217,7 +218,8 @@ int flex_array_put(struct flex_array *fa, int element_nr, void *src, gfp_t flags
* *
* Locking must be provided by the caller. * Locking must be provided by the caller.
*/ */
int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags) int flex_array_prealloc(struct flex_array *fa, unsigned int start,
unsigned int end, gfp_t flags)
{ {
int start_part; int start_part;
int end_part; int end_part;
@ -248,7 +250,7 @@ int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags)
* *
* Locking must be provided by the caller. * Locking must be provided by the caller.
*/ */
void *flex_array_get(struct flex_array *fa, int element_nr) void *flex_array_get(struct flex_array *fa, unsigned int element_nr)
{ {
int part_nr = fa_element_to_part_nr(fa, element_nr); int part_nr = fa_element_to_part_nr(fa, element_nr);
struct flex_array_part *part; struct flex_array_part *part;