| Message ID | 20240719192744.work.264-kees@kernel.org (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | slab: Introduce kmalloc_obj() and family | expand |
On Fri, 19 Jul 2024, Kees Cook wrote: > diff --git a/include/linux/slab.h b/include/linux/slab.h > index 7247e217e21b..3817554f2d51 100644 > --- a/include/linux/slab.h > +++ b/include/linux/slab.h > @@ -665,6 +665,44 @@ static __always_inline __alloc_size(1) void *kmalloc_noprof(size_t size, gfp_t f > } > #define kmalloc(...) alloc_hooks(kmalloc_noprof(__VA_ARGS__)) > > +#define __alloc_obj3(ALLOC, P, COUNT, FLAGS) \ > +({ \ > + size_t __obj_size = size_mul(sizeof(*P), COUNT); \ > + void *__obj_ptr; \ > + (P) = __obj_ptr = ALLOC(__obj_size, FLAGS); \ > + if (!__obj_ptr) \ > + __obj_size = 0; \ > + __obj_size; \ > +}) > + > +#define __alloc_obj2(ALLOC, P, FLAGS) __alloc_obj3(ALLOC, P, 1, FLAGS) > + > +#define __alloc_obj4(ALLOC, P, FAM, COUNT, FLAGS) \ > +({ \ > + size_t __obj_size = struct_size(P, FAM, COUNT); \ > + void *__obj_ptr; \ > + (P) = __obj_ptr = ALLOC(__obj_size, FLAGS); \ > + if (!__obj_ptr) \ > + __obj_size = 0; \ > + __obj_size; \ > +}) > + > +#define kmalloc_obj(...) \ > + CONCATENATE(__alloc_obj, \ > + COUNT_ARGS(__VA_ARGS__))(kmalloc, __VA_ARGS__) > + > +#define kzalloc_obj(...) \ > + CONCATENATE(__alloc_obj, \ > + COUNT_ARGS(__VA_ARGS__))(kzalloc, __VA_ARGS__) > + > +#define kvmalloc_obj(...) \ > + CONCATENATE(__alloc_obj, \ > + COUNT_ARGS(__VA_ARGS__))(kvmalloc, __VA_ARGS__) > + > +#define kvzalloc_obj(...) \ > + CONCATENATE(__alloc_obj, \ > + COUNT_ARGS(__VA_ARGS__))(kvzalloc, __VA_ARGS__) > + > static __always_inline __alloc_size(1) void *kmalloc_node_noprof(size_t size, gfp_t flags, int node) > { > if (__builtin_constant_p(size) && size) { I'm supportive of this especially because it will pave a pathway toward future hardening work. Request: could we get an addition to Documentation/ that explains how common idioms today can be converted to these new macros for future users? The above makes sense only when accompanied by your commit description :)
On Fri, Jul 19, 2024 at 08:50:41PM -0700, David Rientjes wrote: > On Fri, 19 Jul 2024, Kees Cook wrote: > > > diff --git a/include/linux/slab.h b/include/linux/slab.h > > index 7247e217e21b..3817554f2d51 100644 > > --- a/include/linux/slab.h > > +++ b/include/linux/slab.h > > @@ -665,6 +665,44 @@ static __always_inline __alloc_size(1) void *kmalloc_noprof(size_t size, gfp_t f > > } > > #define kmalloc(...) alloc_hooks(kmalloc_noprof(__VA_ARGS__)) > > > > +#define __alloc_obj3(ALLOC, P, COUNT, FLAGS) \ > > +({ \ > > + size_t __obj_size = size_mul(sizeof(*P), COUNT); \ > > + void *__obj_ptr; \ > > + (P) = __obj_ptr = ALLOC(__obj_size, FLAGS); \ > > + if (!__obj_ptr) \ > > + __obj_size = 0; \ > > + __obj_size; \ > > +}) > > + > > +#define __alloc_obj2(ALLOC, P, FLAGS) __alloc_obj3(ALLOC, P, 1, FLAGS) > > + > > +#define __alloc_obj4(ALLOC, P, FAM, COUNT, FLAGS) \ > > +({ \ > > + size_t __obj_size = struct_size(P, FAM, COUNT); \ > > + void *__obj_ptr; \ > > + (P) = __obj_ptr = ALLOC(__obj_size, FLAGS); \ > > + if (!__obj_ptr) \ > > + __obj_size = 0; \ > > + __obj_size; \ > > +}) > > + > > +#define kmalloc_obj(...) \ > > + CONCATENATE(__alloc_obj, \ > > + COUNT_ARGS(__VA_ARGS__))(kmalloc, __VA_ARGS__) > > + > > +#define kzalloc_obj(...) \ > > + CONCATENATE(__alloc_obj, \ > > + COUNT_ARGS(__VA_ARGS__))(kzalloc, __VA_ARGS__) > > + > > +#define kvmalloc_obj(...) \ > > + CONCATENATE(__alloc_obj, \ > > + COUNT_ARGS(__VA_ARGS__))(kvmalloc, __VA_ARGS__) > > + > > +#define kvzalloc_obj(...) \ > > + CONCATENATE(__alloc_obj, \ > > + COUNT_ARGS(__VA_ARGS__))(kvzalloc, __VA_ARGS__) > > + > > static __always_inline __alloc_size(1) void *kmalloc_node_noprof(size_t size, gfp_t flags, int node) > > { > > if (__builtin_constant_p(size) && size) { > > I'm supportive of this especially because it will pave a pathway toward > future hardening work. Request: could we get an addition to Thanks! > Documentation/ that explains how common idioms today can be converted to > these new macros for future users? The above makes sense only when > accompanied by your commit description :) Oh, yes. Very good point! I will figure out a place to add this. I'm not sure if kerndoc would be best here.
diff --git a/include/linux/slab.h b/include/linux/slab.h index 7247e217e21b..3817554f2d51 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -665,6 +665,44 @@ static __always_inline __alloc_size(1) void *kmalloc_noprof(size_t size, gfp_t f } #define kmalloc(...) alloc_hooks(kmalloc_noprof(__VA_ARGS__)) +#define __alloc_obj3(ALLOC, P, COUNT, FLAGS) \ +({ \ + size_t __obj_size = size_mul(sizeof(*P), COUNT); \ + void *__obj_ptr; \ + (P) = __obj_ptr = ALLOC(__obj_size, FLAGS); \ + if (!__obj_ptr) \ + __obj_size = 0; \ + __obj_size; \ +}) + +#define __alloc_obj2(ALLOC, P, FLAGS) __alloc_obj3(ALLOC, P, 1, FLAGS) + +#define __alloc_obj4(ALLOC, P, FAM, COUNT, FLAGS) \ +({ \ + size_t __obj_size = struct_size(P, FAM, COUNT); \ + void *__obj_ptr; \ + (P) = __obj_ptr = ALLOC(__obj_size, FLAGS); \ + if (!__obj_ptr) \ + __obj_size = 0; \ + __obj_size; \ +}) + +#define kmalloc_obj(...) \ + CONCATENATE(__alloc_obj, \ + COUNT_ARGS(__VA_ARGS__))(kmalloc, __VA_ARGS__) + +#define kzalloc_obj(...) \ + CONCATENATE(__alloc_obj, \ + COUNT_ARGS(__VA_ARGS__))(kzalloc, __VA_ARGS__) + +#define kvmalloc_obj(...) \ + CONCATENATE(__alloc_obj, \ + COUNT_ARGS(__VA_ARGS__))(kvmalloc, __VA_ARGS__) + +#define kvzalloc_obj(...) \ + CONCATENATE(__alloc_obj, \ + COUNT_ARGS(__VA_ARGS__))(kvzalloc, __VA_ARGS__) + static __always_inline __alloc_size(1) void *kmalloc_node_noprof(size_t size, gfp_t flags, int node) { if (__builtin_constant_p(size) && size) {
Introduce type-aware kmalloc-family helpers to replace the common idioms for single, array, and flexible object allocations: ptr = kmalloc(sizeof(*ptr), gfp); ptr = kcalloc(count, sizeof(*ptr), gfp); ptr = kmalloc_array(count, sizeof(*ptr), gfp); ptr = kcalloc(count, sizeof(*ptr), gfp); ptr = kmalloc(struct_size(ptr, flex_member, count), gfp); These become, respectively: kmalloc_obj(p, gfp); kzalloc_obj(p, count, gfp); kmalloc_obj(p, count, gfp); kzalloc_obj(p, count, gfp); kmalloc_obj(p, flex_member, count, gfp); These each return the size of the allocation, so that other common idioms can be converted easily as well. For example: info->size = struct_size(ptr, flex_member, count); ptr = kmalloc(info->size, gfp); becomes: info->size = kmalloc_obj(ptr, flex_member, count, gfp); Internal introspection of allocated type also becomes possible, allowing for alignment-aware choices and future hardening work. For example, adding __alignof(*ptr) as an argument to the internal allocators so that appropriate/efficient alignment choices can be made, or being able to correctly choose per-allocation offset randomization within a bucket that does not break alignment requirements. Additionally, once __builtin_set_counted_by() (or equivalent) is added by GCC and Clang, it will be possible to automatically set the counted member of a struct with a counted_by FAM, further eliminating open-coded redundant initializations: info->size = struct_size(ptr, flex_member, count); ptr = kmalloc(info->size, gfp); ptr->flex_count = count; becomes (i.e. unchanged from earlier example): info->size = kmalloc_obj(ptr, flex_member, count, gfp); Replacing all existing simple code patterns via Coccinelle[1] shows what could be replaced immediately (saving roughly 1,500 lines): 7040 files changed, 14128 insertions(+), 15557 deletions(-) Link: https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/kmalloc_obj-assign-size.cocci [1] Signed-off-by: Kees Cook <kees@kernel.org> --- Cc: Vlastimil Babka <vbabka@suse.cz> Cc: Christoph Lameter <cl@linux.com> Cc: Pekka Enberg <penberg@kernel.org> Cc: David Rientjes <rientjes@google.com> Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Roman Gushchin <roman.gushchin@linux.dev> Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Gustavo A. R. Silva <gustavoars@kernel.org> Cc: Bill Wendling <morbo@google.com> Cc: Justin Stitt <justinstitt@google.com> Cc: Jann Horn <jannh@google.com> Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com> Cc: Marco Elver <elver@google.com> Cc: linux-mm@kvack.org --- include/linux/slab.h | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+)