Messages in this thread | | | Date | Thu, 9 Feb 2012 14:56:42 +0200 | Subject | Re: integer overflows in kernel/relay.c | From | Pekka Enberg <> |
| |
On Thu, Feb 9, 2012 at 12:25 AM, Andrew Morton <akpm@linux-foundation.org> wrote: > On Wed, 08 Feb 2012 09:34:16 +0100 > Jens Axboe <axboe@kernel.dk> wrote: > >> On 02/07/2012 03:11 PM, Dan Carpenter wrote: >> > My static checker is warning about integer overflows in kernel/relay.c >> > >> > relay_create_buf() >> > 170 >> > 171 buf->padding = kmalloc(chan->n_subbufs * sizeof(size_t *), GFP_KERNEL); >> > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >> > This can only overflow on 32bit systems. >> >> Correct > > This is a relatively common problem. Converting a kzalloc() call to > kcalloc() fixes it. But we do not have a non-zeroing version of > kcalloc(). > > Please, someone complete this patch and send it to me! > > > --- a/include/linux/slab.h~a > +++ a/include/linux/slab.h > @@ -240,11 +240,16 @@ size_t ksize(const void *); > * for general use, and so are not documented here. For a full list of > * potential flags, always refer to linux/gfp.h. > */ > -static inline void *kcalloc(size_t n, size_t size, gfp_t flags) > +static inline void *wtf_do_i_call_this(size_t n, size_t size, gfp_t flags)
I'd call it kmalloc_array().
> { > if (size != 0 && n > ULONG_MAX / size) > return NULL; > - return __kmalloc(n * size, flags | __GFP_ZERO); > + return __kmalloc(n * size, flags); > +} -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |