Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b62e408c authored by David Rientjes's avatar David Rientjes Committed by Linus Torvalds
Browse files

flex_array: convert element_nr formals to unsigned 



It's problematic to allow signed element_nr's or total's to be passed as
part of the flex array API.

flex_array_alloc() allows total_nr_elements to be set to a negative
quantity, which is obviously erroneous.

flex_array_get() and flex_array_put() allows negative array indices in
dereferencing an array part, which could address memory mapped before
struct flex_array.

The fix is to convert all existing element_nr formals to be qualified as
unsigned.  Existing checks to compare it to total_nr_elements or the max
array size based on element_size need not be changed.

Signed-off-by: default avatarDavid Rientjes <rientjes@google.com>
Cc: Dave Hansen <dave@linux.vnet.ibm.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 8e7ee270

include/linux/flex_array.h

+6 −4
Original line number Diff line number Diff line
@@ -36,12 +36,14 @@ struct flex_array { 
	.total_nr_elements = (total),	\

} } }



struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags);

int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags);

struct flex_array *flex_array_alloc(int element_size, unsigned int total,

		gfp_t flags);

int flex_array_prealloc(struct flex_array *fa, unsigned int start,

		unsigned int end, gfp_t flags);

void flex_array_free(struct flex_array *fa);

void flex_array_free_parts(struct flex_array *fa);

int flex_array_put(struct flex_array *fa, int element_nr, void *src,

int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,

		gfp_t flags);

void *flex_array_get(struct flex_array *fa, int element_nr);

void *flex_array_get(struct flex_array *fa, unsigned int element_nr);



#endif /* _FLEX_ARRAY_H */

lib/flex_array.c

+13 −11
Original line number Diff line number Diff line
@@ -99,7 +99,8 @@ static inline int elements_fit_in_base(struct flex_array *fa) 
 * capacity in the base structure.  Also note that no effort is made

 * to efficiently pack objects across page boundaries.

 */

struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags)

struct flex_array *flex_array_alloc(int element_size, unsigned int total,

					gfp_t flags)

{

	struct flex_array *ret;

	int max_size = nr_base_part_ptrs() * __elements_per_part(element_size);
@@ -115,7 +116,8 @@ struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags) 
	return ret;

}



static int fa_element_to_part_nr(struct flex_array *fa, int element_nr)

static int fa_element_to_part_nr(struct flex_array *fa,

					unsigned int element_nr)

{

	return element_nr / __elements_per_part(fa->element_size);

}
@@ -143,14 +145,12 @@ void flex_array_free(struct flex_array *fa) 
	kfree(fa);

}



static int fa_index_inside_part(struct flex_array *fa, int element_nr)

static unsigned int index_inside_part(struct flex_array *fa,

					unsigned int element_nr)

{

	return element_nr % __elements_per_part(fa->element_size);

}

	unsigned int part_offset;



static int index_inside_part(struct flex_array *fa, int element_nr)

{

	int part_offset = fa_index_inside_part(fa, element_nr);

	part_offset = element_nr % __elements_per_part(fa->element_size);

	return part_offset * fa->element_size;

}
@@ -185,7 +185,8 @@ __fa_get_part(struct flex_array *fa, int part_nr, gfp_t flags) 
 *

 * Locking must be provided by the caller.

 */

int flex_array_put(struct flex_array *fa, int element_nr, void *src, gfp_t flags)

int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,

			gfp_t flags)

{

	int part_nr = fa_element_to_part_nr(fa, element_nr);

	struct flex_array_part *part;
@@ -217,7 +218,8 @@ int flex_array_put(struct flex_array *fa, int element_nr, void *src, gfp_t flags 
 *

 * Locking must be provided by the caller.

 */

int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags)

int flex_array_prealloc(struct flex_array *fa, unsigned int start,

			unsigned int end, gfp_t flags)

{

	int start_part;

	int end_part;
@@ -248,7 +250,7 @@ int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags) 
 *

 * Locking must be provided by the caller.

 */

void *flex_array_get(struct flex_array *fa, int element_nr)

void *flex_array_get(struct flex_array *fa, unsigned int element_nr)

{

	int part_nr = fa_element_to_part_nr(fa, element_nr);

	struct flex_array_part *part;