]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commit
treewide: Use struct_size() for kmalloc()-family
authorKees Cook <keescook@chromium.org>
Tue, 8 May 2018 20:45:50 +0000 (13:45 -0700)
committerKees Cook <keescook@chromium.org>
Wed, 6 Jun 2018 18:15:43 +0000 (11:15 -0700)
commitacafe7e30216166a17e6e226aadc3ecb63993242
treec0c8f6c55123b9963e8d15bf1bd49fd8e5f628b2
parent2509b561f7c6599907c08cb364c86b8c45466e4f
treewide: Use struct_size() for kmalloc()-family

One of the more common cases of allocation size calculations is finding
the size of a structure that has a zero-sized array at the end, along
with memory for some number of elements for that array. For example:

struct foo {
    int stuff;
    void *entry[];
};

instance = kmalloc(sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL);

Instead of leaving these open-coded and prone to type mistakes, we can
now use the new struct_size() helper:

instance = kmalloc(struct_size(instance, entry, count), GFP_KERNEL);

This patch makes the changes for kmalloc()-family (and kvmalloc()-family)
uses. It was done via automatic conversion with manual review for the
"CHECKME" non-standard cases noted below, using the following Coccinelle
script:

// pkey_cache = kmalloc(sizeof *pkey_cache + tprops->pkey_tbl_len *
//                      sizeof *pkey_cache->table, GFP_KERNEL);
@@
identifier alloc =~ "kmalloc|kzalloc|kvmalloc|kvzalloc";
expression GFP;
identifier VAR, ELEMENT;
expression COUNT;
@@

- alloc(sizeof(*VAR) + COUNT * sizeof(*VAR->ELEMENT), GFP)
+ alloc(struct_size(VAR, ELEMENT, COUNT), GFP)

// mr = kzalloc(sizeof(*mr) + m * sizeof(mr->map[0]), GFP_KERNEL);
@@
identifier alloc =~ "kmalloc|kzalloc|kvmalloc|kvzalloc";
expression GFP;
identifier VAR, ELEMENT;
expression COUNT;
@@

- alloc(sizeof(*VAR) + COUNT * sizeof(VAR->ELEMENT[0]), GFP)
+ alloc(struct_size(VAR, ELEMENT, COUNT), GFP)

// Same pattern, but can't trivially locate the trailing element name,
// or variable name.
@@
identifier alloc =~ "kmalloc|kzalloc|kvmalloc|kvzalloc";
expression GFP;
expression SOMETHING, COUNT, ELEMENT;
@@

- alloc(sizeof(SOMETHING) + COUNT * sizeof(ELEMENT), GFP)
+ alloc(CHECKME_struct_size(&SOMETHING, ELEMENT, COUNT), GFP)

Signed-off-by: Kees Cook <keescook@chromium.org>
53 files changed:
drivers/clk/bcm/clk-iproc-asiu.c
drivers/clk/bcm/clk-iproc-pll.c
drivers/clk/berlin/bg2.c
drivers/clk/berlin/bg2q.c
drivers/clk/clk-asm9260.c
drivers/clk/clk-aspeed.c
drivers/clk/clk-clps711x.c
drivers/clk/clk-efm32gg.c
drivers/clk/clk-gemini.c
drivers/clk/clk-stm32h7.c
drivers/clk/clk-stm32mp1.c
drivers/clk/samsung/clk-exynos-clkout.c
drivers/dax/device.c
drivers/dma/edma.c
drivers/dma/moxart-dma.c
drivers/dma/omap-dma.c
drivers/dma/sa11x0-dma.c
drivers/dma/sh/usb-dmac.c
drivers/firewire/core-topology.c
drivers/gpio/gpiolib.c
drivers/gpu/drm/nouveau/nvkm/engine/pm/base.c
drivers/hwspinlock/omap_hwspinlock.c
drivers/hwspinlock/u8500_hsem.c
drivers/infiniband/core/cache.c
drivers/infiniband/core/cm.c
drivers/infiniband/core/multicast.c
drivers/infiniband/core/uverbs_cmd.c
drivers/infiniband/core/uverbs_ioctl_merge.c
drivers/infiniband/hw/mthca/mthca_memfree.c
drivers/infiniband/sw/rdmavt/mr.c
drivers/input/input-leds.c
drivers/input/input-mt.c
drivers/md/dm-raid.c
drivers/misc/vexpress-syscfg.c
drivers/net/ethernet/mellanox/mlx5/core/debugfs.c
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
drivers/net/wireless/mediatek/mt76/agg-rx.c
drivers/reset/core.c
drivers/s390/cio/ccwgroup.c
drivers/staging/greybus/module.c
drivers/usb/gadget/function/f_midi.c
drivers/zorro/zorro.c
fs/afs/addr_list.c
kernel/cgroup/cgroup.c
kernel/module.c
kernel/workqueue.c
net/ceph/mon_client.c
net/ceph/osd_client.c
net/netfilter/xt_recent.c
net/sctp/endpointola.c
sound/core/vmaster.c
sound/soc/soc-dapm.c