[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1518643449.3678.33.camel@perches.com>
Date: Wed, 14 Feb 2018 13:24:09 -0800
From: Joe Perches <joe@...ches.com>
To: Matthew Wilcox <willy@...radead.org>
Cc: Andrew Morton <akpm@...ux-foundation.org>, Matthew Wilcox
<mawilcox@...rosoft.com>, linux-mm@...ck.org, Kees Cook
<keescook@...omium.org>, linux-kernel@...r.kernel.org,
kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH v2 2/8] mm: Add kvmalloc_ab_c and kvzalloc_struct
On Wed, 2018-02-14 at 13:12 -0800, Matthew Wilcox wrote:
> On Wed, Feb 14, 2018 at 12:45:52PM -0800, Joe Perches wrote:
> > On Wed, 2018-02-14 at 12:11 -0800, Matthew Wilcox wrote:
> > > We have kvmalloc_array in order to safely allocate an array with a
> > > number of elements specified by userspace (avoiding arithmetic overflow
> > > leading to a buffer overrun). But it's fairly common to have a header
> > > in front of that array (eg specifying the length of the array), so we
> > > need a helper function for that situation.
> > >
> > > kvmalloc_ab_c() is the workhorse that does the calculation, but in spite
> > > of our best efforts to name the arguments, it's really hard to remember
> > > which order to put the arguments in. kvzalloc_struct() eliminates that
> > > effort; you tell it about the struct you're allocating, and it puts the
> > > arguments in the right order for you (and checks that the arguments
> > > you've given are at least plausible).
> > >
> > > For comparison between the three schemes:
> > >
> > > sev = kvzalloc(sizeof(*sev) + sizeof(struct v4l2_kevent) * elems,
> > > GFP_KERNEL);
> > > sev = kvzalloc_ab_c(elems, sizeof(struct v4l2_kevent), sizeof(*sev),
> > > GFP_KERNEL);
> > > sev = kvzalloc_struct(sev, events, elems, GFP_KERNEL);
> >
> > Perhaps kv[zm]alloc_buf_and_array is better naming.
>
> I think that's actively misleading. The programmer isn't allocating a
> buf, they're allocating a struct. kvzalloc_hdr_arr was the earlier name,
> and that made some sense; they're allocating an array with a header.
> But nobody thinks about it like that; they're allocating a structure
> with a variably sized array at the end of it.
>
> If C macros had decent introspection, I'd like it to be:
>
> sev = kvzalloc_struct(elems, GFP_KERNEL);
>
> and have the macro examine the structure pointed to by 'sev', check
> the last element was an array, calculate the size of the array element,
> and call kvzalloc_ab_c. But we don't live in that world, so I have to
> get the programmer to tell me the structure and the name of the last
> element in it.
Look at your patch 4
- dev_dax = kzalloc(sizeof(*dev_dax) + sizeof(*res) * count, GFP_KERNEL);
+ dev_dax = kvzalloc_struct(dev_dax, res, count, GFP_KERNEL);
Here what is being allocated is exactly a struct
and an array.
And this doesn't compile either.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
