From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1161192AbcHELhR (ORCPT <rfc822;w@1wt.eu>);
	Fri, 5 Aug 2016 07:37:17 -0400
Received: from mail-wm0-f44.google.com ([74.125.82.44]:36814 "EHLO
	mail-wm0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S934814AbcHELhP (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Fri, 5 Aug 2016 07:37:15 -0400
Date: Fri, 5 Aug 2016 12:37:01 +0100
From: Matt Fleming <matt@codeblueprint.co.uk>
To: Joe Perches <joe@perches.com>
Cc: Chris Metcalf <cmetcalf@tilera.com>, Arnd Bergmann <arnd@arndb.de>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Ferruh Yigit <fery@cypress.com>,
        Dmitry Torokhov <dmitry.torokhov@gmail.com>,
        Jaroslav Kysela <perex@perex.cz>, Takashi Iwai <tiwai@suse.com>,
        LKML <linux-kernel@vger.kernel.org>
Subject: Re: possible krealloc with __GFP_ZERO defects
Message-ID: <20160805113701.GO3636@codeblueprint.co.uk>
References: <1469726831.3998.44.camel@perches.com>
 <1469729491.3998.58.camel@perches.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <1469729491.3998.58.camel@perches.com>
User-Agent: Mutt/1.5.24+41 (02bc14ed1569) (2015-08-30)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, 28 Jul, at 11:11:31AM, Joe Perches wrote:
> (forwarding to the maintainers of other uses)
> 
> On Thu, 2016-07-28 at 10:27 -0700, Joe Perches wrote:
> > There is a defect in krealloc with __GFP_ZERO so this code in
> > drivers/chat/tile-srom.c may not work properly:
> > 
> > drivers/char/tile-srom.c-       for (i = 0; ; i++) {
> > drivers/char/tile-srom.c-               int devhdl;
> > drivers/char/tile-srom.c-               char buf[20];
> > drivers/char/tile-srom.c-               struct srom_dev *new_srom_devices =
> > drivers/char/tile-srom.c-                       krealloc(srom_devices, (i+1) * sizeof(struct srom_dev),
> > drivers/char/tile-srom.c:                                GFP_KERNEL | __GFP_ZERO);
> > drivers/char/tile-srom.c-               if (!new_srom_devices) {
> > drivers/char/tile-srom.c-                       result = -ENOMEM;
> > drivers/char/tile-srom.c-                       goto fail_mem;
> > drivers/char/tile-srom.c-               }
> > drivers/char/tile-srom.c-               srom_devices = new_srom_devices;
> > 
> > http://linux-kernel.vger.kernel.narkive.com/xyiQV3vf/slab-krealloc-with-gfp-zero-defect
> 
> Here are the other in-tree uses that may not work properly
> 
> $ grep-2.5.4 -rP --include=*.[ch] -n "krealloc[^;]+__GFP_ZERO" *
> drivers/firmware/efi/capsule-loader.c:87:	temp_page = krealloc(cap_info->pages,
> 			     pages_needed * sizeof(void *),
> 			     GFP_KERNEL | __GFP_ZERO);
> drivers/char/tile-srom.c:375:			krealloc(srom_devices, (i+1) * sizeof(struct srom_dev),
> 				 GFP_KERNEL | __GFP_ZERO);
> drivers/input/touchscreen/cyttsp4_core.c:521:		p = krealloc(si->btn, si->si_ofs.btn_keys_size,
> 				GFP_KERNEL|__GFP_ZERO);
> drivers/input/touchscreen/cyttsp4_core.c:565:	p = krealloc(si->xy_mode, si->si_ofs.mode_size, GFP_KERNEL|__GFP_ZERO);
> drivers/input/touchscreen/cyttsp4_core.c:570:	p = krealloc(si->xy_data, si->si_ofs.data_size, GFP_KERNEL|__GFP_ZERO);
> drivers/input/touchscreen/cyttsp4_core.c:575:	p = krealloc(si->btn_rec_data,
> 			si->si_ofs.btn_rec_size * si->si_ofs.num_btns,
> 			GFP_KERNEL|__GFP_ZERO);
> sound/hda/array.c:28:		nlist = krealloc(array->list, size, GFP_KERNEL | __GFP_ZERO);
> sound/core/info.c:342:		char *nbuf = krealloc(buf->buffer, PAGE_ALIGN(next),
> 				      GFP_KERNEL | __GFP_ZERO);

Isn't this a bug in krealloc()?