Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 28576760 authored by Linus Torvalds's avatar Linus Torvalds
Browse files
Pull overflow updates from Kees Cook:
 "This adds the new overflow checking helpers and adds them to the
  2-factor argument allocators. And this adds the saturating size
  helpers and does a treewide replacement for the struct_size() usage.
  Additionally this adds the overflow testing modules to make sure
  everything works.

  I'm still working on the treewide replacements for allocators with
  "simple" multiplied arguments:

     *alloc(a * b, ...) -> *alloc_array(a, b, ...)

  and

     *zalloc(a * b, ...) -> *calloc(a, b, ...)

  as well as the more complex cases, but that's separable from this
  portion of the series. I expect to have the rest sent before -rc1
  closes; there are a lot of messy cases to clean up.

  Summary:

   - Introduce arithmetic overflow test helper functions (Rasmus)

   - Use overflow helpers in 2-factor allocators (Kees, Rasmus)

   - Introduce overflow test module (Rasmus, Kees)

   - Introduce saturating size helper functions (Matthew, Kees)

   - Treewide use of struct_size() for allocators (Kees)"

* tag 'overflow-v4.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  treewide: Use struct_size() for devm_kmalloc() and friends
  treewide: Use struct_size() for vmalloc()-family
  treewide: Use struct_size() for kmalloc()-family
  device: Use overflow helpers for devm_kmalloc()
  mm: Use overflow helpers in kvmalloc()
  mm: Use overflow helpers in kmalloc_array*()
  test_overflow: Add memory allocation overflow tests
  overflow.h: Add allocation size calculation helpers
  test_overflow: Report test failures
  test_overflow: macrofy some more, do more tests for free
  lib: add runtime test of check_*_overflow functions
  compiler.h: enable builtin overflow checkers and add fallback code
parents 5eb6eed7 0ed2dd03
Loading
Loading
Loading
Loading
+2 −2
Original line number Diff line number Diff line
@@ -500,8 +500,8 @@ int af_alg_alloc_tsgl(struct sock *sk)
		sg = sgl->sg;

	if (!sg || sgl->cur >= MAX_SGL_ENTS) {
		sgl = sock_kmalloc(sk, sizeof(*sgl) +
				       sizeof(sgl->sg[0]) * (MAX_SGL_ENTS + 1),
		sgl = sock_kmalloc(sk,
				   struct_size(sgl, sg, (MAX_SGL_ENTS + 1)),
				   GFP_KERNEL);
		if (!sgl)
			return -ENOMEM;
+6 −1
Original line number Diff line number Diff line
@@ -84,9 +84,14 @@ static struct devres_group * node_to_group(struct devres_node *node)
static __always_inline struct devres * alloc_dr(dr_release_t release,
						size_t size, gfp_t gfp, int nid)
{
	size_t tot_size = sizeof(struct devres) + size;
	size_t tot_size;
	struct devres *dr;

	/* We must catch any near-SIZE_MAX cases that could overflow. */
	if (unlikely(check_add_overflow(sizeof(struct devres), size,
					&tot_size)))
		return NULL;

	dr = kmalloc_node_track_caller(tot_size, gfp, nid);
	if (unlikely(!dr))
		return NULL;
+4 −2
Original line number Diff line number Diff line
@@ -40,8 +40,10 @@ static int bcm2835_aux_clk_probe(struct platform_device *pdev)
	if (IS_ERR(reg))
		return PTR_ERR(reg);

	onecell = devm_kmalloc(dev, sizeof(*onecell) + sizeof(*onecell->hws) *
			       BCM2835_AUX_CLOCK_COUNT, GFP_KERNEL);
	onecell = devm_kmalloc(dev,
			       struct_size(onecell, hws,
					   BCM2835_AUX_CLOCK_COUNT),
			       GFP_KERNEL);
	if (!onecell)
		return -ENOMEM;
	onecell->num = BCM2835_AUX_CLOCK_COUNT;
+2 −2
Original line number Diff line number Diff line
@@ -2147,8 +2147,8 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
	size_t i;
	int ret;

	cprman = devm_kzalloc(dev, sizeof(*cprman) +
			      sizeof(*cprman->onecell.hws) * asize,
	cprman = devm_kzalloc(dev,
			      struct_size(cprman, onecell.hws, asize),
			      GFP_KERNEL);
	if (!cprman)
		return -ENOMEM;
+2 −2
Original line number Diff line number Diff line
@@ -197,8 +197,8 @@ void __init iproc_asiu_setup(struct device_node *node,
	if (WARN_ON(!asiu))
		return;

	asiu->clk_data = kzalloc(sizeof(*asiu->clk_data->hws) * num_clks +
				 sizeof(*asiu->clk_data), GFP_KERNEL);
	asiu->clk_data = kzalloc(struct_size(asiu->clk_data, hws, num_clks),
				 GFP_KERNEL);
	if (WARN_ON(!asiu->clk_data))
		goto err_clks;
	asiu->clk_data->num = num_clks;
Loading