From: Joe Perches <joe@perches.com>
To: Chris Metcalf <cmetcalf@tilera.com>,
Matt Fleming <matt@codeblueprint.co.uk>,
Arnd Bergmann <arnd@arndb.de>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Ferruh Yigit <fery@cypress.com>,
Dmitry Torokhov <dmitry.torokhov@gmail.com>,
Jaroslav Kysela <perex@perex.cz>, Takashi Iwai <tiwai@suse.com>
Cc: LKML <linux-kernel@vger.kernel.org>
Subject: possible krealloc with __GFP_ZERO defects
Date: Thu, 28 Jul 2016 11:11:31 -0700 [thread overview]
Message-ID: <1469729491.3998.58.camel@perches.com> (raw)
In-Reply-To: <1469726831.3998.44.camel@perches.com>
(forwarding to the maintainers of other uses)
On Thu, 2016-07-28 at 10:27 -0700, Joe Perches wrote:
> There is a defect in krealloc with __GFP_ZERO so this code in
> drivers/chat/tile-srom.c may not work properly:
>
> drivers/char/tile-srom.c- for (i = 0; ; i++) {
> drivers/char/tile-srom.c- int devhdl;
> drivers/char/tile-srom.c- char buf[20];
> drivers/char/tile-srom.c- struct srom_dev *new_srom_devices =
> drivers/char/tile-srom.c- krealloc(srom_devices, (i+1) * sizeof(struct srom_dev),
> drivers/char/tile-srom.c: GFP_KERNEL | __GFP_ZERO);
> drivers/char/tile-srom.c- if (!new_srom_devices) {
> drivers/char/tile-srom.c- result = -ENOMEM;
> drivers/char/tile-srom.c- goto fail_mem;
> drivers/char/tile-srom.c- }
> drivers/char/tile-srom.c- srom_devices = new_srom_devices;
>
> http://linux-kernel.vger.kernel.narkive.com/xyiQV3vf/slab-krealloc-with-gfp-zero-defect
Here are the other in-tree uses that may not work properly
$ grep-2.5.4 -rP --include=*.[ch] -n "krealloc[^;]+__GFP_ZERO" *
drivers/firmware/efi/capsule-loader.c:87: temp_page = krealloc(cap_info->pages,
pages_needed * sizeof(void *),
GFP_KERNEL | __GFP_ZERO);
drivers/char/tile-srom.c:375: krealloc(srom_devices, (i+1) * sizeof(struct srom_dev),
GFP_KERNEL | __GFP_ZERO);
drivers/input/touchscreen/cyttsp4_core.c:521: p = krealloc(si->btn, si->si_ofs.btn_keys_size,
GFP_KERNEL|__GFP_ZERO);
drivers/input/touchscreen/cyttsp4_core.c:565: p = krealloc(si->xy_mode, si->si_ofs.mode_size, GFP_KERNEL|__GFP_ZERO);
drivers/input/touchscreen/cyttsp4_core.c:570: p = krealloc(si->xy_data, si->si_ofs.data_size, GFP_KERNEL|__GFP_ZERO);
drivers/input/touchscreen/cyttsp4_core.c:575: p = krealloc(si->btn_rec_data,
si->si_ofs.btn_rec_size * si->si_ofs.num_btns,
GFP_KERNEL|__GFP_ZERO);
sound/hda/array.c:28: nlist = krealloc(array->list, size, GFP_KERNEL | __GFP_ZERO);
sound/core/info.c:342: char *nbuf = krealloc(buf->buffer, PAGE_ALIGN(next),
GFP_KERNEL | __GFP_ZERO);
next prev parent reply other threads:[~2016-07-28 18:11 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-28 17:27 tile-srom and krealloc with __GFP_ZERO defect Joe Perches
2016-07-28 18:11 ` Joe Perches [this message]
2016-07-28 19:07 ` [PATCH] tile-srom: avoid krealloc(... __GFP_ZERO) pattern Chris Metcalf
2016-08-05 11:37 ` possible krealloc with __GFP_ZERO defects Matt Fleming
2016-08-05 15:25 ` Joe Perches
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1469729491.3998.58.camel@perches.com \
--to=joe@perches.com \
--cc=arnd@arndb.de \
--cc=cmetcalf@tilera.com \
--cc=dmitry.torokhov@gmail.com \
--cc=fery@cypress.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=matt@codeblueprint.co.uk \
--cc=perex@perex.cz \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).