All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 0/6] More conversions to struct_size
@ 2018-06-07 14:57 Matthew Wilcox
  2018-06-07 14:57 ` [PATCH 1/6] Convert virtio_console " Matthew Wilcox
                   ` (5 more replies)
  0 siblings, 6 replies; 15+ messages in thread
From: Matthew Wilcox @ 2018-06-07 14:57 UTC (permalink / raw)
  To: Kees Cook; +Cc: Matthew Wilcox, linux-mm, linux-kernel, kernel-hardening

From: Matthew Wilcox <mawilcox@microsoft.com>

Hi Kees,

Here are some patches which I had in my tree as demonstrations of
converting code to use kvzalloc_struct.  I've ported them to use
struct_size instead, since these spots weren't caught by your coccinelle
scripts.  Some of them are far too manual to have ever been doable by
a tool.  Maybe some of them will inspire more automated fixes though.

Matthew Wilcox (6):
  Convert virtio_console to struct_size
  Convert infiniband uverbs to struct_size
  Convert v4l2 event to struct_size
  Convert vhost to struct_size
  Convert jffs2 acl to struct_size
  Convert intel uncore to struct_size

 arch/x86/events/intel/uncore.c       | 19 ++++++++++---------
 drivers/char/virtio_console.c        |  3 +--
 drivers/infiniband/core/uverbs_cmd.c |  4 ++--
 drivers/media/v4l2-core/v4l2-event.c |  3 +--
 drivers/vhost/vhost.c                |  3 ++-
 fs/jffs2/acl.c                       |  3 ++-
 fs/jffs2/acl.h                       |  1 +
 include/rdma/ib_verbs.h              |  5 +----
 8 files changed, 20 insertions(+), 21 deletions(-)

-- 
2.17.0

^ permalink raw reply	[flat|nested] 15+ messages in thread

* [PATCH 1/6] Convert virtio_console to struct_size
  2018-06-07 14:57 [PATCH 0/6] More conversions to struct_size Matthew Wilcox
@ 2018-06-07 14:57 ` Matthew Wilcox
  2018-06-07 19:29   ` Kees Cook
  2018-06-07 14:57 ` [PATCH 2/6] Convert infiniband uverbs " Matthew Wilcox
                   ` (4 subsequent siblings)
  5 siblings, 1 reply; 15+ messages in thread
From: Matthew Wilcox @ 2018-06-07 14:57 UTC (permalink / raw)
  To: Kees Cook; +Cc: Matthew Wilcox, linux-mm, linux-kernel, kernel-hardening

From: Matthew Wilcox <mawilcox@microsoft.com>

Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
---
 drivers/char/virtio_console.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 21085515814f..4bf7c06c2343 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -433,8 +433,7 @@ static struct port_buffer *alloc_buf(struct virtio_device *vdev, size_t buf_size
 	 * Allocate buffer and the sg list. The sg list array is allocated
 	 * directly after the port_buffer struct.
 	 */
-	buf = kmalloc(sizeof(*buf) + sizeof(struct scatterlist) * pages,
-		      GFP_KERNEL);
+	buf = kmalloc(struct_size(buf, sg, pages), GFP_KERNEL);
 	if (!buf)
 		goto fail;
 
-- 
2.17.0

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 2/6] Convert infiniband uverbs to struct_size
  2018-06-07 14:57 [PATCH 0/6] More conversions to struct_size Matthew Wilcox
  2018-06-07 14:57 ` [PATCH 1/6] Convert virtio_console " Matthew Wilcox
@ 2018-06-07 14:57 ` Matthew Wilcox
  2018-06-07 14:57 ` [PATCH 3/6] Convert v4l2 event " Matthew Wilcox
                   ` (3 subsequent siblings)
  5 siblings, 0 replies; 15+ messages in thread
From: Matthew Wilcox @ 2018-06-07 14:57 UTC (permalink / raw)
  To: Kees Cook; +Cc: Matthew Wilcox, linux-mm, linux-kernel, kernel-hardening

From: Matthew Wilcox <mawilcox@microsoft.com>

The flows were hidden from the C compiler; expose them as a zero-length
array to allow struct_size to work.

Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
---
 drivers/infiniband/core/uverbs_cmd.c | 4 ++--
 include/rdma/ib_verbs.h              | 5 +----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index e3662a8ee465..67cab6102f7a 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -3478,8 +3478,8 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
 		goto err_uobj;
 	}
 
-	flow_attr = kzalloc(sizeof(*flow_attr) + cmd.flow_attr.num_of_specs *
-			    sizeof(union ib_flow_spec), GFP_KERNEL);
+	flow_attr = kzalloc(struct_size(flow_attr, flows,
+				cmd.flow_attr.num_of_specs), GFP_KERNEL);
 	if (!flow_attr) {
 		err = -ENOMEM;
 		goto err_put;
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 9fc8a825aa28..bb6125ceb187 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -2035,10 +2035,7 @@ struct ib_flow_attr {
 	u32	     flags;
 	u8	     num_of_specs;
 	u8	     port;
-	/* Following are the optional layers according to user request
-	 * struct ib_flow_spec_xxx
-	 * struct ib_flow_spec_yyy
-	 */
+	union ib_flow_spec flows[];
 };
 
 struct ib_flow {
-- 
2.17.0

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 3/6] Convert v4l2 event to struct_size
  2018-06-07 14:57 [PATCH 0/6] More conversions to struct_size Matthew Wilcox
  2018-06-07 14:57 ` [PATCH 1/6] Convert virtio_console " Matthew Wilcox
  2018-06-07 14:57 ` [PATCH 2/6] Convert infiniband uverbs " Matthew Wilcox
@ 2018-06-07 14:57 ` Matthew Wilcox
  2018-06-08  4:03   ` kbuild test robot
  2018-06-07 14:57 ` [PATCH 4/6] Convert vhost " Matthew Wilcox
                   ` (2 subsequent siblings)
  5 siblings, 1 reply; 15+ messages in thread
From: Matthew Wilcox @ 2018-06-07 14:57 UTC (permalink / raw)
  To: Kees Cook; +Cc: Matthew Wilcox, linux-mm, linux-kernel, kernel-hardening

From: Matthew Wilcox <mawilcox@microsoft.com>

Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
---
 drivers/media/v4l2-core/v4l2-event.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
index 968c2eb08b5a..127fe6eb91d9 100644
--- a/drivers/media/v4l2-core/v4l2-event.c
+++ b/drivers/media/v4l2-core/v4l2-event.c
@@ -215,8 +215,7 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
 	if (elems < 1)
 		elems = 1;
 
-	sev = kvzalloc(sizeof(*sev) + sizeof(struct v4l2_kevent) * elems,
-		       GFP_KERNEL);
+	sev = kvzalloc(struct_size(sev, events, elems), GFP_KERNEL);
 	if (!sev)
 		return -ENOMEM;
 	for (i = 0; i < elems; i++)
-- 
2.17.0

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 4/6] Convert vhost to struct_size
  2018-06-07 14:57 [PATCH 0/6] More conversions to struct_size Matthew Wilcox
                   ` (2 preceding siblings ...)
  2018-06-07 14:57 ` [PATCH 3/6] Convert v4l2 event " Matthew Wilcox
@ 2018-06-07 14:57 ` Matthew Wilcox
  2018-06-07 14:57 ` [PATCH 5/6] Convert jffs2 acl " Matthew Wilcox
  2018-06-07 14:57 ` [PATCH 6/6] Convert intel uncore " Matthew Wilcox
  5 siblings, 0 replies; 15+ messages in thread
From: Matthew Wilcox @ 2018-06-07 14:57 UTC (permalink / raw)
  To: Kees Cook; +Cc: Matthew Wilcox, linux-mm, linux-kernel, kernel-hardening

From: Matthew Wilcox <mawilcox@microsoft.com>

Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
---
 drivers/vhost/vhost.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 895eaa25807c..f9bce818da11 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1286,7 +1286,8 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
 		return -EOPNOTSUPP;
 	if (mem.nregions > max_mem_regions)
 		return -E2BIG;
-	newmem = kvzalloc(size + mem.nregions * sizeof(*m->regions), GFP_KERNEL);
+	newmem = kvzalloc(struct_size(newmem, regions, mem.nregions),
+			GFP_KERNEL);
 	if (!newmem)
 		return -ENOMEM;
 
-- 
2.17.0

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 5/6] Convert jffs2 acl to struct_size
  2018-06-07 14:57 [PATCH 0/6] More conversions to struct_size Matthew Wilcox
                   ` (3 preceding siblings ...)
  2018-06-07 14:57 ` [PATCH 4/6] Convert vhost " Matthew Wilcox
@ 2018-06-07 14:57 ` Matthew Wilcox
  2018-06-07 14:57 ` [PATCH 6/6] Convert intel uncore " Matthew Wilcox
  5 siblings, 0 replies; 15+ messages in thread
From: Matthew Wilcox @ 2018-06-07 14:57 UTC (permalink / raw)
  To: Kees Cook; +Cc: Matthew Wilcox, linux-mm, linux-kernel, kernel-hardening

From: Matthew Wilcox <mawilcox@microsoft.com>

Need to tell the compiler that the acl entries follow the acl header.

Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
---
 fs/jffs2/acl.c | 3 ++-
 fs/jffs2/acl.h | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/jffs2/acl.c b/fs/jffs2/acl.c
index 7ebacf14837f..093ffbd82395 100644
--- a/fs/jffs2/acl.c
+++ b/fs/jffs2/acl.c
@@ -133,7 +133,8 @@ static void *jffs2_acl_to_medium(const struct posix_acl *acl, size_t *size)
 	size_t i;
 
 	*size = jffs2_acl_size(acl->a_count);
-	header = kmalloc(sizeof(*header) + acl->a_count * sizeof(*entry), GFP_KERNEL);
+	header = kmalloc(struct_size(header, a_entries, acl->a_count),
+			GFP_KERNEL);
 	if (!header)
 		return ERR_PTR(-ENOMEM);
 	header->a_version = cpu_to_je32(JFFS2_ACL_VERSION);
diff --git a/fs/jffs2/acl.h b/fs/jffs2/acl.h
index 2e2b5745c3b7..12d0271bdde3 100644
--- a/fs/jffs2/acl.h
+++ b/fs/jffs2/acl.h
@@ -22,6 +22,7 @@ struct jffs2_acl_entry_short {
 
 struct jffs2_acl_header {
 	jint32_t	a_version;
+	struct jffs2_acl_entry	a_entries[];
 };
 
 #ifdef CONFIG_JFFS2_FS_POSIX_ACL
-- 
2.17.0

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* [PATCH 6/6] Convert intel uncore to struct_size
  2018-06-07 14:57 [PATCH 0/6] More conversions to struct_size Matthew Wilcox
                   ` (4 preceding siblings ...)
  2018-06-07 14:57 ` [PATCH 5/6] Convert jffs2 acl " Matthew Wilcox
@ 2018-06-07 14:57 ` Matthew Wilcox
  2018-06-07 17:29     ` Ralph Campbell
                     ` (2 more replies)
  5 siblings, 3 replies; 15+ messages in thread
From: Matthew Wilcox @ 2018-06-07 14:57 UTC (permalink / raw)
  To: Kees Cook; +Cc: Matthew Wilcox, linux-mm, linux-kernel, kernel-hardening

From: Matthew Wilcox <mawilcox@microsoft.com>

Need to do a bit of rearranging to make this work.

Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
---
 arch/x86/events/intel/uncore.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 15b07379e72d..e15cfad4f89b 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -865,8 +865,6 @@ static void uncore_types_exit(struct intel_uncore_type **types)
 static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
 {
 	struct intel_uncore_pmu *pmus;
-	struct attribute_group *attr_group;
-	struct attribute **attrs;
 	size_t size;
 	int i, j;
 
@@ -891,21 +889,24 @@ static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
 				0, type->num_counters, 0, 0);
 
 	if (type->event_descs) {
+		struct {
+			struct attribute_group group;
+			struct attribute *attrs[];
+		} *attr_group;
 		for (i = 0; type->event_descs[i].attr.attr.name; i++);
 
-		attr_group = kzalloc(sizeof(struct attribute *) * (i + 1) +
-					sizeof(*attr_group), GFP_KERNEL);
+		attr_group = kzalloc(struct_size(attr_group, attrs, i + 1),
+								GFP_KERNEL);
 		if (!attr_group)
 			goto err;
 
-		attrs = (struct attribute **)(attr_group + 1);
-		attr_group->name = "events";
-		attr_group->attrs = attrs;
+		attr_group->group.name = "events";
+		attr_group->group.attrs = attr_group->attrs;
 
 		for (j = 0; j < i; j++)
-			attrs[j] = &type->event_descs[j].attr.attr;
+			attr_group->attrs[j] = &type->event_descs[j].attr.attr;
 
-		type->events_group = attr_group;
+		type->events_group = &attr_group->group;
 	}
 
 	type->pmu_group = &uncore_pmu_attr_group;
-- 
2.17.0

^ permalink raw reply related	[flat|nested] 15+ messages in thread

* Re: [PATCH 6/6] Convert intel uncore to struct_size
  2018-06-07 14:57 ` [PATCH 6/6] Convert intel uncore " Matthew Wilcox
@ 2018-06-07 17:29     ` Ralph Campbell
  2018-06-08  4:03   ` kbuild test robot
  2018-06-08  4:09   ` kbuild test robot
  2 siblings, 0 replies; 15+ messages in thread
From: Ralph Campbell @ 2018-06-07 17:29 UTC (permalink / raw)
  To: Matthew Wilcox, Kees Cook
  Cc: Matthew Wilcox, linux-mm, linux-kernel, kernel-hardening



On 06/07/2018 07:57 AM, Matthew Wilcox wrote:
> From: Matthew Wilcox <mawilcox@microsoft.com>
> 
> Need to do a bit of rearranging to make this work.
> 
> Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
> ---
>   arch/x86/events/intel/uncore.c | 19 ++++++++++---------
>   1 file changed, 10 insertions(+), 9 deletions(-)
> 
> diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
> index 15b07379e72d..e15cfad4f89b 100644
> --- a/arch/x86/events/intel/uncore.c
> +++ b/arch/x86/events/intel/uncore.c
> @@ -865,8 +865,6 @@ static void uncore_types_exit(struct intel_uncore_type **types)
>   static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
>   {
>   	struct intel_uncore_pmu *pmus;
> -	struct attribute_group *attr_group;
> -	struct attribute **attrs;
>   	size_t size;
>   	int i, j;
>   
> @@ -891,21 +889,24 @@ static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
>   				0, type->num_counters, 0, 0);
>   
>   	if (type->event_descs) {
> +		struct {
> +			struct attribute_group group;
> +			struct attribute *attrs[];
> +		} *attr_group;
>   		for (i = 0; type->event_descs[i].attr.attr.name; i++);

What does this for loop do?
Looks like nothing given the semicolon at the end.

> -		attr_group = kzalloc(sizeof(struct attribute *) * (i + 1) +
> -					sizeof(*attr_group), GFP_KERNEL);
> +		attr_group = kzalloc(struct_size(attr_group, attrs, i + 1),
> +								GFP_KERNEL);
>   		if (!attr_group)
>   			goto err;
>   
> -		attrs = (struct attribute **)(attr_group + 1);
> -		attr_group->name = "events";
> -		attr_group->attrs = attrs;
> +		attr_group->group.name = "events";
> +		attr_group->group.attrs = attr_group->attrs;
>   
>   		for (j = 0; j < i; j++)
> -			attrs[j] = &type->event_descs[j].attr.attr;
> +			attr_group->attrs[j] = &type->event_descs[j].attr.attr;
>   
> -		type->events_group = attr_group;
> +		type->events_group = &attr_group->group;
>   	}
>   
>   	type->pmu_group = &uncore_pmu_attr_group;
> 

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH 6/6] Convert intel uncore to struct_size
@ 2018-06-07 17:29     ` Ralph Campbell
  0 siblings, 0 replies; 15+ messages in thread
From: Ralph Campbell @ 2018-06-07 17:29 UTC (permalink / raw)
  To: Matthew Wilcox, Kees Cook
  Cc: Matthew Wilcox, linux-mm, linux-kernel, kernel-hardening



On 06/07/2018 07:57 AM, Matthew Wilcox wrote:
> From: Matthew Wilcox <mawilcox@microsoft.com>
> 
> Need to do a bit of rearranging to make this work.
> 
> Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
> ---
>   arch/x86/events/intel/uncore.c | 19 ++++++++++---------
>   1 file changed, 10 insertions(+), 9 deletions(-)
> 
> diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
> index 15b07379e72d..e15cfad4f89b 100644
> --- a/arch/x86/events/intel/uncore.c
> +++ b/arch/x86/events/intel/uncore.c
> @@ -865,8 +865,6 @@ static void uncore_types_exit(struct intel_uncore_type **types)
>   static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
>   {
>   	struct intel_uncore_pmu *pmus;
> -	struct attribute_group *attr_group;
> -	struct attribute **attrs;
>   	size_t size;
>   	int i, j;
>   
> @@ -891,21 +889,24 @@ static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
>   				0, type->num_counters, 0, 0);
>   
>   	if (type->event_descs) {
> +		struct {
> +			struct attribute_group group;
> +			struct attribute *attrs[];
> +		} *attr_group;
>   		for (i = 0; type->event_descs[i].attr.attr.name; i++);

What does this for loop do?
Looks like nothing given the semicolon at the end.

> -		attr_group = kzalloc(sizeof(struct attribute *) * (i + 1) +
> -					sizeof(*attr_group), GFP_KERNEL);
> +		attr_group = kzalloc(struct_size(attr_group, attrs, i + 1),
> +								GFP_KERNEL);
>   		if (!attr_group)
>   			goto err;
>   
> -		attrs = (struct attribute **)(attr_group + 1);
> -		attr_group->name = "events";
> -		attr_group->attrs = attrs;
> +		attr_group->group.name = "events";
> +		attr_group->group.attrs = attr_group->attrs;
>   
>   		for (j = 0; j < i; j++)
> -			attrs[j] = &type->event_descs[j].attr.attr;
> +			attr_group->attrs[j] = &type->event_descs[j].attr.attr;
>   
> -		type->events_group = attr_group;
> +		type->events_group = &attr_group->group;
>   	}
>   
>   	type->pmu_group = &uncore_pmu_attr_group;
> 

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH 6/6] Convert intel uncore to struct_size
  2018-06-07 17:29     ` Ralph Campbell
  (?)
@ 2018-06-07 17:34     ` Shakeel Butt
  -1 siblings, 0 replies; 15+ messages in thread
From: Shakeel Butt @ 2018-06-07 17:34 UTC (permalink / raw)
  To: rcampbell
  Cc: Matthew Wilcox, keescook, Matthew Wilcox, Linux MM, LKML,
	kernel-hardening

On Thu, Jun 7, 2018 at 10:30 AM Ralph Campbell <rcampbell@nvidia.com> wrote:
>
>
>
> On 06/07/2018 07:57 AM, Matthew Wilcox wrote:
> > From: Matthew Wilcox <mawilcox@microsoft.com>
> >
> > Need to do a bit of rearranging to make this work.
> >
> > Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
> > ---
> >   arch/x86/events/intel/uncore.c | 19 ++++++++++---------
> >   1 file changed, 10 insertions(+), 9 deletions(-)
> >
> > diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
> > index 15b07379e72d..e15cfad4f89b 100644
> > --- a/arch/x86/events/intel/uncore.c
> > +++ b/arch/x86/events/intel/uncore.c
> > @@ -865,8 +865,6 @@ static void uncore_types_exit(struct intel_uncore_type **types)
> >   static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
> >   {
> >       struct intel_uncore_pmu *pmus;
> > -     struct attribute_group *attr_group;
> > -     struct attribute **attrs;
> >       size_t size;
> >       int i, j;
> >
> > @@ -891,21 +889,24 @@ static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
> >                               0, type->num_counters, 0, 0);
> >
> >       if (type->event_descs) {
> > +             struct {
> > +                     struct attribute_group group;
> > +                     struct attribute *attrs[];
> > +             } *attr_group;
> >               for (i = 0; type->event_descs[i].attr.attr.name; i++);
>
> What does this for loop do?
> Looks like nothing given the semicolon at the end.
>

Finding the first index 'i' where type->event_descs[i].attr.attr.name
is NULL with the assumption that one such entry definitely exists.

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH 1/6] Convert virtio_console to struct_size
  2018-06-07 14:57 ` [PATCH 1/6] Convert virtio_console " Matthew Wilcox
@ 2018-06-07 19:29   ` Kees Cook
  2018-06-07 20:43     ` Kees Cook
  0 siblings, 1 reply; 15+ messages in thread
From: Kees Cook @ 2018-06-07 19:29 UTC (permalink / raw)
  To: Matthew Wilcox; +Cc: Matthew Wilcox, Linux-MM, LKML, Kernel Hardening

On Thu, Jun 7, 2018 at 7:57 AM, Matthew Wilcox <willy@infradead.org> wrote:
> From: Matthew Wilcox <mawilcox@microsoft.com>
>
> Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
> ---
>  drivers/char/virtio_console.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
> index 21085515814f..4bf7c06c2343 100644
> --- a/drivers/char/virtio_console.c
> +++ b/drivers/char/virtio_console.c
> @@ -433,8 +433,7 @@ static struct port_buffer *alloc_buf(struct virtio_device *vdev, size_t buf_size
>          * Allocate buffer and the sg list. The sg list array is allocated
>          * directly after the port_buffer struct.
>          */
> -       buf = kmalloc(sizeof(*buf) + sizeof(struct scatterlist) * pages,
> -                     GFP_KERNEL);
> +       buf = kmalloc(struct_size(buf, sg, pages), GFP_KERNEL);
>         if (!buf)
>                 goto fail;

I feel like this one should have been caught by Coccinelle... maybe
the transitive case got missed? Regardless, I'll figure out how to
improve the script and/or take these.

Thanks!

-Kees

-- 
Kees Cook
Pixel Security

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH 1/6] Convert virtio_console to struct_size
  2018-06-07 19:29   ` Kees Cook
@ 2018-06-07 20:43     ` Kees Cook
  0 siblings, 0 replies; 15+ messages in thread
From: Kees Cook @ 2018-06-07 20:43 UTC (permalink / raw)
  To: Matthew Wilcox; +Cc: Matthew Wilcox, Linux-MM, LKML, Kernel Hardening

On Thu, Jun 7, 2018 at 12:29 PM, Kees Cook <keescook@chromium.org> wrote:
> On Thu, Jun 7, 2018 at 7:57 AM, Matthew Wilcox <willy@infradead.org> wrote:
>> From: Matthew Wilcox <mawilcox@microsoft.com>
>>
>> Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
>> ---
>>  drivers/char/virtio_console.c | 3 +--
>>  1 file changed, 1 insertion(+), 2 deletions(-)
>>
>> diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
>> index 21085515814f..4bf7c06c2343 100644
>> --- a/drivers/char/virtio_console.c
>> +++ b/drivers/char/virtio_console.c
>> @@ -433,8 +433,7 @@ static struct port_buffer *alloc_buf(struct virtio_device *vdev, size_t buf_size
>>          * Allocate buffer and the sg list. The sg list array is allocated
>>          * directly after the port_buffer struct.
>>          */
>> -       buf = kmalloc(sizeof(*buf) + sizeof(struct scatterlist) * pages,
>> -                     GFP_KERNEL);
>> +       buf = kmalloc(struct_size(buf, sg, pages), GFP_KERNEL);
>>         if (!buf)
>>                 goto fail;
>
> I feel like this one should have been caught by Coccinelle... maybe
> the transitive case got missed? Regardless, I'll figure out how to
> improve the script and/or take these.

Oh, duh. Got it: "struct scatterlist" is not an expression, it's a
type. I'll adjust the script, catch stragglers, and incorporate your
patches. :)

Thanks!

-Kees

-- 
Kees Cook
Pixel Security

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH 6/6] Convert intel uncore to struct_size
  2018-06-07 14:57 ` [PATCH 6/6] Convert intel uncore " Matthew Wilcox
  2018-06-07 17:29     ` Ralph Campbell
@ 2018-06-08  4:03   ` kbuild test robot
  2018-06-08  4:09   ` kbuild test robot
  2 siblings, 0 replies; 15+ messages in thread
From: kbuild test robot @ 2018-06-08  4:03 UTC (permalink / raw)
  To: Matthew Wilcox
  Cc: kbuild-all, Kees Cook, Matthew Wilcox, linux-mm, linux-kernel,
	kernel-hardening

[-- Attachment #1: Type: text/plain, Size: 3395 bytes --]

Hi Matthew,

I love your patch! Yet something to improve:

[auto build test ERROR on linus/master]
[also build test ERROR on v4.17 next-20180607]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Matthew-Wilcox/More-conversions-to-struct_size/20180608-112654
config: x86_64-randconfig-x015-201822 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-16) 7.3.0
reproduce:
        # save the attached .config to linux build tree
        make ARCH=x86_64 

All errors (new ones prefixed by >>):

   arch/x86/events/intel/uncore.c: In function 'uncore_type_init':
>> arch/x86/events/intel/uncore.c:838:24: error: implicit declaration of function 'struct_size'; did you mean 'bd_set_size'? [-Werror=implicit-function-declaration]
      attr_group = kzalloc(struct_size(attr_group, attrs, i + 1),
                           ^~~~~~~~~~~
                           bd_set_size
>> arch/x86/events/intel/uncore.c:838:48: error: 'attrs' undeclared (first use in this function); did you mean 'iattr'?
      attr_group = kzalloc(struct_size(attr_group, attrs, i + 1),
                                                   ^~~~~
                                                   iattr
   arch/x86/events/intel/uncore.c:838:48: note: each undeclared identifier is reported only once for each function it appears in
   cc1: some warnings being treated as errors

vim +838 arch/x86/events/intel/uncore.c

   804	
   805	static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
   806	{
   807		struct intel_uncore_pmu *pmus;
   808		size_t size;
   809		int i, j;
   810	
   811		pmus = kzalloc(sizeof(*pmus) * type->num_boxes, GFP_KERNEL);
   812		if (!pmus)
   813			return -ENOMEM;
   814	
   815		size = max_packages * sizeof(struct intel_uncore_box *);
   816	
   817		for (i = 0; i < type->num_boxes; i++) {
   818			pmus[i].func_id	= setid ? i : -1;
   819			pmus[i].pmu_idx	= i;
   820			pmus[i].type	= type;
   821			pmus[i].boxes	= kzalloc(size, GFP_KERNEL);
   822			if (!pmus[i].boxes)
   823				goto err;
   824		}
   825	
   826		type->pmus = pmus;
   827		type->unconstrainted = (struct event_constraint)
   828			__EVENT_CONSTRAINT(0, (1ULL << type->num_counters) - 1,
   829					0, type->num_counters, 0, 0);
   830	
   831		if (type->event_descs) {
   832			struct {
   833				struct attribute_group group;
   834				struct attribute *attrs[];
   835			} *attr_group;
   836			for (i = 0; type->event_descs[i].attr.attr.name; i++);
   837	
 > 838			attr_group = kzalloc(struct_size(attr_group, attrs, i + 1),
   839									GFP_KERNEL);
   840			if (!attr_group)
   841				goto err;
   842	
   843			attr_group->group.name = "events";
   844			attr_group->group.attrs = attr_group->attrs;
   845	
   846			for (j = 0; j < i; j++)
   847				attr_group->attrs[j] = &type->event_descs[j].attr.attr;
   848	
   849			type->events_group = &attr_group->group;
   850		}
   851	
   852		type->pmu_group = &uncore_pmu_attr_group;
   853	
   854		return 0;
   855	
   856	err:
   857		for (i = 0; i < type->num_boxes; i++)
   858			kfree(pmus[i].boxes);
   859		kfree(pmus);
   860	
   861		return -ENOMEM;
   862	}
   863	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 26831 bytes --]

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH 3/6] Convert v4l2 event to struct_size
  2018-06-07 14:57 ` [PATCH 3/6] Convert v4l2 event " Matthew Wilcox
@ 2018-06-08  4:03   ` kbuild test robot
  0 siblings, 0 replies; 15+ messages in thread
From: kbuild test robot @ 2018-06-08  4:03 UTC (permalink / raw)
  To: Matthew Wilcox
  Cc: kbuild-all, Kees Cook, Matthew Wilcox, linux-mm, linux-kernel,
	kernel-hardening

[-- Attachment #1: Type: text/plain, Size: 3150 bytes --]

Hi Matthew,

I love your patch! Yet something to improve:

[auto build test ERROR on linus/master]
[also build test ERROR on v4.17 next-20180607]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Matthew-Wilcox/More-conversions-to-struct_size/20180608-112654
config: x86_64-randconfig-x017-201822 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-16) 7.3.0
reproduce:
        # save the attached .config to linux build tree
        make ARCH=x86_64 

All errors (new ones prefixed by >>):

   drivers/media/v4l2-core/v4l2-event.c: In function 'v4l2_event_subscribe':
>> drivers/media/v4l2-core/v4l2-event.c:218:17: error: implicit declaration of function 'struct_size'; did you mean 'resource_size'? [-Werror=implicit-function-declaration]
     sev = kvzalloc(struct_size(sev, events, elems), GFP_KERNEL);
                    ^~~~~~~~~~~
                    resource_size
   drivers/media/v4l2-core/v4l2-event.c:218:34: error: 'events' undeclared (first use in this function); did you mean 'elems'?
     sev = kvzalloc(struct_size(sev, events, elems), GFP_KERNEL);
                                     ^~~~~~
                                     elems
   drivers/media/v4l2-core/v4l2-event.c:218:34: note: each undeclared identifier is reported only once for each function it appears in
   cc1: some warnings being treated as errors

vim +218 drivers/media/v4l2-core/v4l2-event.c

   203	
   204	int v4l2_event_subscribe(struct v4l2_fh *fh,
   205				 const struct v4l2_event_subscription *sub, unsigned elems,
   206				 const struct v4l2_subscribed_event_ops *ops)
   207	{
   208		struct v4l2_subscribed_event *sev, *found_ev;
   209		unsigned long flags;
   210		unsigned i;
   211	
   212		if (sub->type == V4L2_EVENT_ALL)
   213			return -EINVAL;
   214	
   215		if (elems < 1)
   216			elems = 1;
   217	
 > 218		sev = kvzalloc(struct_size(sev, events, elems), GFP_KERNEL);
   219		if (!sev)
   220			return -ENOMEM;
   221		for (i = 0; i < elems; i++)
   222			sev->events[i].sev = sev;
   223		sev->type = sub->type;
   224		sev->id = sub->id;
   225		sev->flags = sub->flags;
   226		sev->fh = fh;
   227		sev->ops = ops;
   228	
   229		spin_lock_irqsave(&fh->vdev->fh_lock, flags);
   230		found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
   231		if (!found_ev)
   232			list_add(&sev->list, &fh->subscribed);
   233		spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
   234	
   235		if (found_ev) {
   236			kvfree(sev);
   237			return 0; /* Already listening */
   238		}
   239	
   240		if (sev->ops && sev->ops->add) {
   241			int ret = sev->ops->add(sev, elems);
   242			if (ret) {
   243				sev->ops = NULL;
   244				v4l2_event_unsubscribe(fh, sub);
   245				return ret;
   246			}
   247		}
   248	
   249		/* Mark as ready for use */
   250		sev->elems = elems;
   251	
   252		return 0;
   253	}
   254	EXPORT_SYMBOL_GPL(v4l2_event_subscribe);
   255	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 28534 bytes --]

^ permalink raw reply	[flat|nested] 15+ messages in thread

* Re: [PATCH 6/6] Convert intel uncore to struct_size
  2018-06-07 14:57 ` [PATCH 6/6] Convert intel uncore " Matthew Wilcox
  2018-06-07 17:29     ` Ralph Campbell
  2018-06-08  4:03   ` kbuild test robot
@ 2018-06-08  4:09   ` kbuild test robot
  2 siblings, 0 replies; 15+ messages in thread
From: kbuild test robot @ 2018-06-08  4:09 UTC (permalink / raw)
  To: Matthew Wilcox
  Cc: kbuild-all, Kees Cook, Matthew Wilcox, linux-mm, linux-kernel,
	kernel-hardening

[-- Attachment #1: Type: text/plain, Size: 3341 bytes --]

Hi Matthew,

I love your patch! Yet something to improve:

[auto build test ERROR on linus/master]
[also build test ERROR on v4.17 next-20180607]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Matthew-Wilcox/More-conversions-to-struct_size/20180608-112654
config: x86_64-randconfig-x016-201822 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-16) 7.3.0
reproduce:
        # save the attached .config to linux build tree
        make ARCH=x86_64 

All errors (new ones prefixed by >>):

   arch/x86/events/intel/uncore.c: In function 'uncore_type_init':
>> arch/x86/events/intel/uncore.c:838:24: error: implicit declaration of function 'struct_size' [-Werror=implicit-function-declaration]
      attr_group = kzalloc(struct_size(attr_group, attrs, i + 1),
                           ^~~~~~~~~~~
   arch/x86/events/intel/uncore.c:838:48: error: 'attrs' undeclared (first use in this function); did you mean 'iattr'?
      attr_group = kzalloc(struct_size(attr_group, attrs, i + 1),
                                                   ^~~~~
                                                   iattr
   arch/x86/events/intel/uncore.c:838:48: note: each undeclared identifier is reported only once for each function it appears in
   cc1: some warnings being treated as errors

vim +/struct_size +838 arch/x86/events/intel/uncore.c

   804	
   805	static int __init uncore_type_init(struct intel_uncore_type *type, bool setid)
   806	{
   807		struct intel_uncore_pmu *pmus;
   808		size_t size;
   809		int i, j;
   810	
   811		pmus = kzalloc(sizeof(*pmus) * type->num_boxes, GFP_KERNEL);
   812		if (!pmus)
   813			return -ENOMEM;
   814	
   815		size = max_packages * sizeof(struct intel_uncore_box *);
   816	
   817		for (i = 0; i < type->num_boxes; i++) {
   818			pmus[i].func_id	= setid ? i : -1;
   819			pmus[i].pmu_idx	= i;
   820			pmus[i].type	= type;
   821			pmus[i].boxes	= kzalloc(size, GFP_KERNEL);
   822			if (!pmus[i].boxes)
   823				goto err;
   824		}
   825	
   826		type->pmus = pmus;
   827		type->unconstrainted = (struct event_constraint)
   828			__EVENT_CONSTRAINT(0, (1ULL << type->num_counters) - 1,
   829					0, type->num_counters, 0, 0);
   830	
   831		if (type->event_descs) {
   832			struct {
   833				struct attribute_group group;
   834				struct attribute *attrs[];
   835			} *attr_group;
   836			for (i = 0; type->event_descs[i].attr.attr.name; i++);
   837	
 > 838			attr_group = kzalloc(struct_size(attr_group, attrs, i + 1),
   839									GFP_KERNEL);
   840			if (!attr_group)
   841				goto err;
   842	
   843			attr_group->group.name = "events";
   844			attr_group->group.attrs = attr_group->attrs;
   845	
   846			for (j = 0; j < i; j++)
   847				attr_group->attrs[j] = &type->event_descs[j].attr.attr;
   848	
   849			type->events_group = &attr_group->group;
   850		}
   851	
   852		type->pmu_group = &uncore_pmu_attr_group;
   853	
   854		return 0;
   855	
   856	err:
   857		for (i = 0; i < type->num_boxes; i++)
   858			kfree(pmus[i].boxes);
   859		kfree(pmus);
   860	
   861		return -ENOMEM;
   862	}
   863	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 24806 bytes --]

^ permalink raw reply	[flat|nested] 15+ messages in thread

end of thread, other threads:[~2018-06-08  4:10 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-06-07 14:57 [PATCH 0/6] More conversions to struct_size Matthew Wilcox
2018-06-07 14:57 ` [PATCH 1/6] Convert virtio_console " Matthew Wilcox
2018-06-07 19:29   ` Kees Cook
2018-06-07 20:43     ` Kees Cook
2018-06-07 14:57 ` [PATCH 2/6] Convert infiniband uverbs " Matthew Wilcox
2018-06-07 14:57 ` [PATCH 3/6] Convert v4l2 event " Matthew Wilcox
2018-06-08  4:03   ` kbuild test robot
2018-06-07 14:57 ` [PATCH 4/6] Convert vhost " Matthew Wilcox
2018-06-07 14:57 ` [PATCH 5/6] Convert jffs2 acl " Matthew Wilcox
2018-06-07 14:57 ` [PATCH 6/6] Convert intel uncore " Matthew Wilcox
2018-06-07 17:29   ` Ralph Campbell
2018-06-07 17:29     ` Ralph Campbell
2018-06-07 17:34     ` Shakeel Butt
2018-06-08  4:03   ` kbuild test robot
2018-06-08  4:09   ` kbuild test robot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.