Skip to content

Commit bf95391

Browse files
torvaldstorvalds
committed
Merge tag 'kspp-misc-fixes-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux
Pull hardening fixes and cleanups from Gustavo A. R. Silva: "Various hardening fixes and cleanups that I've been collecting during the last development cycle: Fix -Wcast-function-type error: - firewire: Remove function callback casts (Oscar Carter) Fix application of sizeof operator: - firmware/psci: fix application of sizeof to pointer (jing yangyang) Replace open coded instances with size_t saturating arithmetic helpers: - assoc_array: Avoid open coded arithmetic in allocator arguments (Len Baker) - writeback: prefer struct_size over open coded arithmetic (Len Baker) - aio: Prefer struct_size over open coded arithmetic (Len Baker) - dmaengine: pxa_dma: Prefer struct_size over open coded arithmetic (Len Baker) Flexible array transformation: - KVM: PPC: Replace zero-length array with flexible array member (Len Baker) Use 2-factor argument multiplication form: - nouveau/svm: Use kvcalloc() instead of kvzalloc() (Gustavo A. R. Silva) - xfs: Use kvcalloc() instead of kvzalloc() (Gustavo A. R. Silva)" * tag 'kspp-misc-fixes-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: firewire: Remove function callback casts nouveau/svm: Use kvcalloc() instead of kvzalloc() firmware/psci: fix application of sizeof to pointer dmaengine: pxa_dma: Prefer struct_size over open coded arithmetic KVM: PPC: Replace zero-length array with flexible array member aio: Prefer struct_size over open coded arithmetic writeback: prefer struct_size over open coded arithmetic xfs: Use kvcalloc() instead of kvzalloc() assoc_array: Avoid open coded arithmetic in allocator arguments
2 parents a5a9e00 + ebe4560 commit bf95391

File tree

11 files changed

+55
-37
lines changed

11 files changed

+55
-37
lines changed

‎arch/powerpc/include/asm/kvm_host.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ struct kvmppc_spapr_tce_table {
190190
u64 size; /* window size in pages */
191191
struct list_head iommu_tables;
192192
struct mutex alloc_lock;
193-
struct page *pages[0];
193+
struct page *pages[];
194194
};
195195

196196
/* XICS components, defined in book3s_xics.c */

‎arch/powerpc/kvm/book3s_64_vio.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -295,8 +295,7 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,
295295
return ret;
296296

297297
ret = -ENOMEM;
298-
stt = kzalloc(sizeof(*stt) + npages * sizeof(struct page *),
299-
GFP_KERNEL);
298+
stt = kzalloc(struct_size(stt, pages, npages), GFP_KERNEL);
300299
if (!stt)
301300
goto fail_acct;
302301

‎drivers/dma/pxa_dma.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -742,8 +742,7 @@ pxad_alloc_desc(struct pxad_chan *chan, unsigned int nb_hw_desc)
742742
dma_addr_t dma;
743743
int i;
744744

745-
sw_desc = kzalloc(sizeof(*sw_desc) +
746-
nb_hw_desc * sizeof(struct pxad_desc_hw *),
745+
sw_desc = kzalloc(struct_size(sw_desc, hw_desc, nb_hw_desc),
747746
GFP_NOWAIT);
748747
if (!sw_desc)
749748
return NULL;

‎drivers/firewire/core-cdev.c

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
#include <linux/delay.h>
1111
#include <linux/device.h>
1212
#include <linux/dma-mapping.h>
13+
#include <linux/err.h>
1314
#include <linux/errno.h>
1415
#include <linux/firewire.h>
1516
#include <linux/firewire-cdev.h>
@@ -953,11 +954,25 @@ static enum dma_data_direction iso_dma_direction(struct fw_iso_context *context)
953954
return DMA_FROM_DEVICE;
954955
}
955956

957+
static struct fw_iso_context *fw_iso_mc_context_create(struct fw_card *card,
958+
fw_iso_mc_callback_t callback,
959+
void *callback_data)
960+
{
961+
struct fw_iso_context *ctx;
962+
963+
ctx = fw_iso_context_create(card, FW_ISO_CONTEXT_RECEIVE_MULTICHANNEL,
964+
0, 0, 0, NULL, callback_data);
965+
if (!IS_ERR(ctx))
966+
ctx->callback.mc = callback;
967+
968+
return ctx;
969+
}
970+
956971
static int ioctl_create_iso_context(struct client *client, union ioctl_arg *arg)
957972
{
958973
struct fw_cdev_create_iso_context *a = &arg->create_iso_context;
959974
struct fw_iso_context *context;
960-
fw_iso_callback_t cb;
975+
union fw_iso_callback cb;
961976
int ret;
962977

963978
BUILD_BUG_ON(FW_CDEV_ISO_CONTEXT_TRANSMIT != FW_ISO_CONTEXT_TRANSMIT ||
@@ -970,27 +985,32 @@ static int ioctl_create_iso_context(struct client *client, union ioctl_arg *arg)
970985
if (a->speed > SCODE_3200 || a->channel > 63)
971986
return -EINVAL;
972987

973-
cb = iso_callback;
988+
cb.sc = iso_callback;
974989
break;
975990

976991
case FW_ISO_CONTEXT_RECEIVE:
977992
if (a->header_size < 4 || (a->header_size & 3) ||
978993
a->channel > 63)
979994
return -EINVAL;
980995

981-
cb = iso_callback;
996+
cb.sc = iso_callback;
982997
break;
983998

984999
case FW_ISO_CONTEXT_RECEIVE_MULTICHANNEL:
985-
cb = (fw_iso_callback_t)iso_mc_callback;
1000+
cb.mc = iso_mc_callback;
9861001
break;
9871002

9881003
default:
9891004
return -EINVAL;
9901005
}
9911006

992-
context = fw_iso_context_create(client->device->card, a->type,
993-
a->channel, a->speed, a->header_size, cb, client);
1007+
if (a->type == FW_ISO_CONTEXT_RECEIVE_MULTICHANNEL)
1008+
context = fw_iso_mc_context_create(client->device->card, cb.mc,
1009+
client);
1010+
else
1011+
context = fw_iso_context_create(client->device->card, a->type,
1012+
a->channel, a->speed,
1013+
a->header_size, cb.sc, client);
9941014
if (IS_ERR(context))
9951015
return PTR_ERR(context);
9961016
if (client->version < FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW)

‎drivers/firmware/psci/psci_checker.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@ static int alloc_init_cpu_groups(cpumask_var_t **pcpu_groups)
155155
if (!alloc_cpumask_var(&tmp, GFP_KERNEL))
156156
return -ENOMEM;
157157

158-
cpu_groups = kcalloc(nb_available_cpus, sizeof(cpu_groups),
158+
cpu_groups = kcalloc(nb_available_cpus, sizeof(*cpu_groups),
159159
GFP_KERNEL);
160160
if (!cpu_groups) {
161161
free_cpumask_var(tmp);

‎drivers/gpu/drm/nouveau/nouveau_svm.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -992,7 +992,7 @@ nouveau_svm_fault_buffer_ctor(struct nouveau_svm *svm, s32 oclass, int id)
992992
if (ret)
993993
return ret;
994994

995-
buffer->fault = kvzalloc(sizeof(*buffer->fault) * buffer->entries, GFP_KERNEL);
995+
buffer->fault = kvcalloc(sizeof(*buffer->fault), buffer->entries, GFP_KERNEL);
996996
if (!buffer->fault)
997997
return -ENOMEM;
998998

‎fs/aio.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -659,8 +659,7 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm)
659659
new_nr = (table ? table->nr : 1) * 4;
660660
spin_unlock(&mm->ioctx_lock);
661661

662-
table = kzalloc(sizeof(*table) + sizeof(struct kioctx *) *
663-
new_nr, GFP_KERNEL);
662+
table = kzalloc(struct_size(table, table, new_nr), GFP_KERNEL);
664663
if (!table)
665664
return -ENOMEM;
666665

‎fs/fs-writeback.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -566,7 +566,7 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
566566
if (atomic_read(&isw_nr_in_flight) > WB_FRN_MAX_IN_FLIGHT)
567567
return;
568568

569-
isw = kzalloc(sizeof(*isw) + 2 * sizeof(struct inode *), GFP_ATOMIC);
569+
isw = kzalloc(struct_size(isw, inodes, 2), GFP_ATOMIC);
570570
if (!isw)
571571
return;
572572

@@ -624,8 +624,8 @@ bool cleanup_offline_cgwb(struct bdi_writeback *wb)
624624
int nr;
625625
bool restart = false;
626626

627-
isw = kzalloc(sizeof(*isw) + WB_MAX_INODES_PER_ISW *
628-
sizeof(struct inode *), GFP_KERNEL);
627+
isw = kzalloc(struct_size(isw, inodes, WB_MAX_INODES_PER_ISW),
628+
GFP_KERNEL);
629629
if (!isw)
630630
return restart;
631631

‎fs/xfs/xfs_ioctl.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1547,7 +1547,7 @@ xfs_ioc_getbmap(
15471547
if (bmx.bmv_count > ULONG_MAX / recsize)
15481548
return -ENOMEM;
15491549

1550-
buf = kvzalloc(bmx.bmv_count * sizeof(*buf), GFP_KERNEL);
1550+
buf = kvcalloc(bmx.bmv_count, sizeof(*buf), GFP_KERNEL);
15511551
if (!buf)
15521552
return -ENOMEM;
15531553

@@ -1601,11 +1601,11 @@ xfs_ioc_getfsmap(
16011601
*/
16021602
count = min_t(unsigned int, head.fmh_count,
16031603
131072 / sizeof(struct fsmap));
1604-
recs = kvzalloc(count * sizeof(struct fsmap), GFP_KERNEL);
1604+
recs = kvcalloc(count, sizeof(struct fsmap), GFP_KERNEL);
16051605
if (!recs) {
16061606
count = min_t(unsigned int, head.fmh_count,
16071607
PAGE_SIZE / sizeof(struct fsmap));
1608-
recs = kvzalloc(count * sizeof(struct fsmap), GFP_KERNEL);
1608+
recs = kvcalloc(count, sizeof(struct fsmap), GFP_KERNEL);
16091609
if (!recs)
16101610
return -ENOMEM;
16111611
}

‎include/linux/firewire.h

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -436,17 +436,20 @@ typedef void (*fw_iso_callback_t)(struct fw_iso_context *context,
436436
void *header, void *data);
437437
typedef void (*fw_iso_mc_callback_t)(struct fw_iso_context *context,
438438
dma_addr_t completed, void *data);
439+
440+
union fw_iso_callback {
441+
fw_iso_callback_t sc;
442+
fw_iso_mc_callback_t mc;
443+
};
444+
439445
struct fw_iso_context {
440446
struct fw_card *card;
441447
int type;
442448
int channel;
443449
int speed;
444450
bool drop_overflow_headers;
445451
size_t header_size;
446-
union {
447-
fw_iso_callback_t sc;
448-
fw_iso_mc_callback_t mc;
449-
} callback;
452+
union fw_iso_callback callback;
450453
void *callback_data;
451454
};
452455

0 commit comments

Comments
 (0)