From patchwork Wed Feb 14 20:11:48 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthew Wilcox X-Patchwork-Id: 10219895 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 30E75601C2 for ; Wed, 14 Feb 2018 20:12:50 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 35DCA288F1 for ; Wed, 14 Feb 2018 20:12:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2A39A28A06; Wed, 14 Feb 2018 20:12:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 42A79288F1 for ; Wed, 14 Feb 2018 20:12:42 +0000 (UTC) Received: (qmail 16197 invoked by uid 550); 14 Feb 2018 20:12:13 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 15898 invoked from network); 14 Feb 2018 20:12:11 -0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=bombadil.20170209; h=References:In-Reply-To:Message-Id: Date:Subject:Cc:To:From:Sender:Reply-To:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=cAdBwm/zWVPodVO96DuAWxPAhDUwcfsDNzKiQMRmZCw=; b=b3ir5amozAHDZpIY1uZx77hTc vR6ai6I+BB8L6J3dyHE6IbKOMQcKLh6yI6OOR/n4Z/iDqhw7CQvgyrHvxz30fRxnB/118Y+/pB1Lk 1hIgbgCyRrl/rVt/t/GRc+54FdrK/65LeYyIqnSWwLhqaAk3nDa26VvTrGfB837K6dP3WymS4vKrw hyDl3kFgs9L6P3ygJb9UuA/guFQq1Sx/NPAJzVqRX01zPCHa6FcLsfM4FlN6WSC0FX2zAMXCU2Wd+ snN0tghUbQocxv709lwCcl4+E6kd9X/UAmwiPlvyBh7ZT0o1jyxcaOmmPnK7OgHe0vfa3Ou32lEvg wig3OSm9A==; From: Matthew Wilcox To: Andrew Morton Cc: Matthew Wilcox , linux-mm@kvack.org, Kees Cook , linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, Joe Perches Subject: [PATCH v2 2/8] mm: Add kvmalloc_ab_c and kvzalloc_struct Date: Wed, 14 Feb 2018 12:11:48 -0800 Message-Id: <20180214201154.10186-3-willy@infradead.org> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20180214201154.10186-1-willy@infradead.org> References: <20180214201154.10186-1-willy@infradead.org> X-Virus-Scanned: ClamAV using ClamSMTP From: Matthew Wilcox We have kvmalloc_array in order to safely allocate an array with a number of elements specified by userspace (avoiding arithmetic overflow leading to a buffer overrun). But it's fairly common to have a header in front of that array (eg specifying the length of the array), so we need a helper function for that situation. kvmalloc_ab_c() is the workhorse that does the calculation, but in spite of our best efforts to name the arguments, it's really hard to remember which order to put the arguments in. kvzalloc_struct() eliminates that effort; you tell it about the struct you're allocating, and it puts the arguments in the right order for you (and checks that the arguments you've given are at least plausible). For comparison between the three schemes: sev = kvzalloc(sizeof(*sev) + sizeof(struct v4l2_kevent) * elems, GFP_KERNEL); sev = kvzalloc_ab_c(elems, sizeof(struct v4l2_kevent), sizeof(*sev), GFP_KERNEL); sev = kvzalloc_struct(sev, events, elems, GFP_KERNEL); Signed-off-by: Matthew Wilcox --- include/linux/mm.h | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/include/linux/mm.h b/include/linux/mm.h index 81bd7f0be286..3b07ba12c8cc 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -557,6 +557,57 @@ static inline void *kvmalloc_array(size_t n, size_t size, gfp_t flags) return kvmalloc(n * size, flags); } +/** + * kvmalloc_ab_c() - Allocate (a * b + c) bytes of memory. + * @n: Number of elements. + * @size: Size of each element (should be constant). + * @c: Size of header (should be constant). + * @gfp: Memory allocation flags. + * + * Use this function to allocate @n * @size + @c bytes of memory. This + * function is safe to use when @n is controlled from userspace; it will + * return %NULL if the required amount of memory cannot be allocated. + * Use kvfree() to free the allocated memory. + * + * The kvzalloc_struct() function is easier to use as it has typechecking + * and you do not need to remember which of the arguments should be constants. + * + * Context: Process context. May sleep; the @gfp flags should be based on + * %GFP_KERNEL. + * Return: A pointer to the allocated memory or %NULL. + */ +static inline __must_check +void *kvmalloc_ab_c(size_t n, size_t size, size_t c, gfp_t gfp) +{ + if (size != 0 && n > (SIZE_MAX - c) / size) + return NULL; + + return kvmalloc(n * size + c, gfp); +} +#define kvzalloc_ab_c(a, b, c, gfp) kvmalloc_ab_c(a, b, c, (gfp) | __GFP_ZERO) + +/** + * kvzalloc_struct() - Allocate and zero-fill a structure containing a + * variable length array. + * @p: Pointer to the structure. + * @member: Name of the array member. + * @n: Number of elements in the array. + * @gfp: Memory allocation flags. + * + * Allocate (and zero-fill) enough memory for a structure with an array + * of @n elements. This function is safe to use when @n is specified by + * userspace as the arithmetic will not overflow. + * Use kvfree() to free the allocated memory. + * + * Context: Process context. May sleep; the @gfp flags should be based on + * %GFP_KERNEL. + * Return: Zero-filled memory or a NULL pointer. + */ +#define kvzalloc_struct(p, member, n, gfp) \ + (typeof(p))kvzalloc_ab_c(n, \ + sizeof(*(p)->member) + __must_be_array((p)->member), \ + offsetof(typeof(*(p)), member), gfp) + extern void kvfree(const void *addr); static inline atomic_t *compound_mapcount_ptr(struct page *page)