lkml.org 
[lkml]   [2012]   [Feb]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: integer overflows in kernel/relay.c
    From
    On Thu, Feb 9, 2012 at 12:25 AM, Andrew Morton
    <akpm@linux-foundation.org> wrote:
    > On Wed, 08 Feb 2012 09:34:16 +0100
    > Jens Axboe <axboe@kernel.dk> wrote:
    >
    >> On 02/07/2012 03:11 PM, Dan Carpenter wrote:
    >> > My static checker is warning about integer overflows in kernel/relay.c
    >> >
    >> > relay_create_buf()
    >> >    170
    >> >    171          buf->padding = kmalloc(chan->n_subbufs * sizeof(size_t *), GFP_KERNEL);
    >> >                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    >> > This can only overflow on 32bit systems.
    >>
    >> Correct
    >
    > This is a relatively common problem.  Converting a kzalloc() call to
    > kcalloc() fixes it.  But we do not have a non-zeroing version of
    > kcalloc().
    >
    > Please, someone complete this patch and send it to me!
    >
    >
    > --- a/include/linux/slab.h~a
    > +++ a/include/linux/slab.h
    > @@ -240,11 +240,16 @@ size_t ksize(const void *);
    >  * for general use, and so are not documented here. For a full list of
    >  * potential flags, always refer to linux/gfp.h.
    >  */
    > -static inline void *kcalloc(size_t n, size_t size, gfp_t flags)
    > +static inline void *wtf_do_i_call_this(size_t n, size_t size, gfp_t flags)

    I'd call it kmalloc_array().

    >  {
    >        if (size != 0 && n > ULONG_MAX / size)
    >                return NULL;
    > -       return __kmalloc(n * size, flags | __GFP_ZERO);
    > +       return __kmalloc(n * size, flags);
    > +}
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2012-02-09 13:59    [W:0.024 / U:32.252 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site