31 Oct, 2011

1 commit


25 May, 2011

1 commit

  • When I was reading nommu code, I found that it handles the vma list/tree
    in an unusual way. IIUC, because there can be more than one
    identical/overrapped vmas in the list/tree, it sorts the tree more
    strictly and does a linear search on the tree. But it doesn't applied to
    the list (i.e. the list could be constructed in a different order than
    the tree so that we can't use the list when finding the first vma in that
    order).

    Since inserting/sorting a vma in the tree and link is done at the same
    time, we can easily construct both of them in the same order. And linear
    searching on the tree could be more costly than doing it on the list, it
    can be converted to use the list.

    Also, after the commit 297c5eee3724 ("mm: make the vma list be doubly
    linked") made the list be doubly linked, there were a couple of code need
    to be fixed to construct the list properly.

    Patch 1/6 is a preparation. It maintains the list sorted same as the tree
    and construct doubly-linked list properly. Patch 2/6 is a simple
    optimization for the vma deletion. Patch 3/6 and 4/6 convert tree
    traversal to list traversal and the rest are simple fixes and cleanups.

    This patch:

    @vma added into @mm should be sorted by start addr, end addr and VMA
    struct addr in that order because we may get identical VMAs in the @mm.
    However this was true only for the rbtree, not for the list.

    This patch fixes this by remembering 'rb_prev' during the tree traversal
    like find_vma_prepare() does and linking the @vma via __vma_link_list().
    After this patch, we can iterate the whole VMAs in correct order simply by
    using @mm->mmap list.

    [akpm@linux-foundation.org: avoid duplicating __vma_link_list()]
    Signed-off-by: Namhyung Kim
    Acked-by: Greg Ungerer
    Cc: David Howells
    Cc: Paul Mundt
    Cc: Geert Uytterhoeven
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Namhyung Kim
     

31 Mar, 2011

1 commit


07 Jan, 2011

1 commit


24 Oct, 2010

1 commit


10 Aug, 2010

1 commit

  • Use memdup_user when user data is immediately copied into the
    allocated region.

    The semantic patch that makes this change is as follows:
    (http://coccinelle.lip6.fr/)

    //
    @@
    expression from,to,size,flag;
    position p;
    identifier l1,l2;
    @@

    - to = \(kmalloc@p\|kzalloc@p\)(size,flag);
    + to = memdup_user(from,size);
    if (
    - to==NULL
    + IS_ERR(to)
    || ...) {

    }
    - if (copy_from_user(to, from, size) != 0) {
    -
    - }
    //

    Signed-off-by: Julia Lawall
    Cc: KOSAKI Motohiro
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Julia Lawall
     

10 Apr, 2010

1 commit

  • As suggested by Linus, introduce a kern_ptr_validate() helper that does some
    sanity checks to make sure a pointer is a valid kernel pointer. This is a
    preparational step for fixing SLUB kmem_ptr_validate().

    Cc: Andrew Morton
    Cc: Christoph Lameter
    Cc: David Rientjes
    Cc: Ingo Molnar
    Cc: Matt Mackall
    Cc: Nick Piggin
    Signed-off-by: Pekka Enberg
    Signed-off-by: Linus Torvalds

    Pekka Enberg
     

17 Jan, 2010

1 commit


31 Dec, 2009

1 commit

  • Move sys_mmap_pgoff() from mm/util.c to mm/mmap.c and mm/nommu.c,
    where we'd expect to find such code: especially now that it contains
    the MAP_HUGETLB handling. Revert mm/util.c to how it was in 2.6.32.

    This patch just ignores MAP_HUGETLB in the nommu case, as in 2.6.32,
    whereas 2.6.33-rc2 reported -ENOSYS. Perhaps validate_mmap_request()
    should reject it with -EINVAL? Add that later if necessary.

    Signed-off-by: Hugh Dickins
    Signed-off-by: Linus Torvalds

    Hugh Dickins
     

11 Dec, 2009

2 commits


17 Jun, 2009

2 commits


01 Jun, 2009

1 commit


07 May, 2009

1 commit


15 Apr, 2009

2 commits

  • Impact: clean up

    Create a sub directory in include/trace called events to keep the
    trace point headers in their own separate directory. Only headers that
    declare trace points should be defined in this directory.

    Cc: Peter Zijlstra
    Cc: Thomas Gleixner
    Cc: Neil Horman
    Cc: Zhao Lei
    Cc: Eduard - Gabriel Munteanu
    Cc: Pekka Enberg
    Signed-off-by: Steven Rostedt

    Steven Rostedt
     
  • This patch lowers the number of places a developer must modify to add
    new tracepoints. The current method to add a new tracepoint
    into an existing system is to write the trace point macro in the
    trace header with one of the macros TRACE_EVENT, TRACE_FORMAT or
    DECLARE_TRACE, then they must add the same named item into the C file
    with the macro DEFINE_TRACE(name) and then add the trace point.

    This change cuts out the needing to add the DEFINE_TRACE(name).
    Every file that uses the tracepoint must still include the trace/.h
    file, but the one C file must also add a define before the including
    of that file.

    #define CREATE_TRACE_POINTS
    #include

    This will cause the trace/mytrace.h file to also produce the C code
    necessary to implement the trace point.

    Note, if more than one trace/.h is used to create the C code
    it is best to list them all together.

    #define CREATE_TRACE_POINTS
    #include
    #include
    #include

    Thanks to Mathieu Desnoyers and Christoph Hellwig for coming up with
    the cleaner solution of the define above the includes over my first
    design to have the C code include a "special" header.

    This patch converts sched, irq and lockdep and skb to use this new
    method.

    Cc: Peter Zijlstra
    Cc: Thomas Gleixner
    Cc: Neil Horman
    Cc: Zhao Lei
    Cc: Eduard - Gabriel Munteanu
    Cc: Pekka Enberg
    Signed-off-by: Steven Rostedt

    Steven Rostedt
     

14 Apr, 2009

1 commit

  • While better than get_user_pages(), the usage of gupf(), especially the
    return values and the fact that it can potentially only partially pin the
    range, warranted some documentation.

    Signed-off-by: Andy Grover
    Cc: Ingo Molnar
    Cc: Nick Piggin
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andy Grover
     

03 Apr, 2009

1 commit

  • kmemtrace now uses tracepoints instead of markers. We no longer need to
    use format specifiers to pass arguments.

    Signed-off-by: Eduard - Gabriel Munteanu
    [ folded: Use the new TP_PROTO and TP_ARGS to fix the build. ]
    [ folded: fix build when CONFIG_KMEMTRACE is disabled. ]
    [ folded: define tracepoints when CONFIG_TRACEPOINTS is enabled. ]
    Signed-off-by: Pekka Enberg
    LKML-Reference:
    Signed-off-by: Ingo Molnar

    Eduard - Gabriel Munteanu
     

01 Apr, 2009

1 commit

  • I notice there are many places doing copy_from_user() which follows
    kmalloc():

    dst = kmalloc(len, GFP_KERNEL);
    if (!dst)
    return -ENOMEM;
    if (copy_from_user(dst, src, len)) {
    kfree(dst);
    return -EFAULT
    }

    memdup_user() is a wrapper of the above code. With this new function, we
    don't have to write 'len' twice, which can lead to typos/mistakes. It
    also produces smaller code and kernel text.

    A quick grep shows 250+ places where memdup_user() *may* be used. I'll
    prepare a patchset to do this conversion.

    Signed-off-by: Li Zefan
    Cc: KOSAKI Motohiro
    Cc: Americo Wang
    Cc: Alexey Dobriyan
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Li Zefan
     

21 Feb, 2009

1 commit

  • kzfree() is a wrapper for kfree() that additionally zeroes the underlying
    memory before releasing it to the slab allocator.

    Currently there is code which memset()s the memory region of an object
    before releasing it back to the slab allocator to make sure
    security-sensitive data are really zeroed out after use.

    These callsites can then just use kzfree() which saves some code, makes
    users greppable and allows for a stupid destructor that isn't necessarily
    aware of the actual object size.

    Signed-off-by: Johannes Weiner
    Reviewed-by: Pekka Enberg
    Cc: Matt Mackall
    Acked-by: Christoph Lameter
    Cc: Nick Piggin
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Johannes Weiner
     

12 Aug, 2008

1 commit


27 Jul, 2008

4 commits

  • * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
    netns: fix ip_rt_frag_needed rt_is_expired
    netfilter: nf_conntrack_extend: avoid unnecessary "ct->ext" dereferences
    netfilter: fix double-free and use-after free
    netfilter: arptables in netns for real
    netfilter: ip{,6}tables_security: fix future section mismatch
    selinux: use nf_register_hooks()
    netfilter: ebtables: use nf_register_hooks()
    Revert "pkt_sched: sch_sfq: dump a real number of flows"
    qeth: use dev->ml_priv instead of dev->priv
    syncookies: Make sure ECN is disabled
    net: drop unused BUG_TRAP()
    net: convert BUG_TRAP to generic WARN_ON
    drivers/net: convert BUG_TRAP to generic WARN_ON

    Linus Torvalds
     
  • mm/util.c: In function 'arch_pick_mmap_layout':
    mm/util.c:144: error: dereferencing pointer to incomplete type
    mm/util.c:145: error: 'arch_get_unmapped_area' undeclared (first use in this function)
    mm/util.c:145: error: (Each undeclared identifier is reported only once
    mm/util.c:145: error: for each function it appears in.)
    mm/util.c:146: error: 'arch_unmap_area' undeclared (first use in this function)

    Signed-off-by: Adrian Bunk
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Adrian Bunk
     
  • As suggested by Patrick McHardy, introduce a __krealloc() that doesn't
    free the original buffer to fix a double-free and use-after-free bug
    introduced by me in netfilter that uses RCU.

    Reported-by: Patrick McHardy
    Signed-off-by: Pekka Enberg
    Tested-by: Dieter Ries
    Signed-off-by: Patrick McHardy
    Signed-off-by: David S. Miller

    Pekka Enberg
     
  • Fix this, on avr32:

    include/linux/utsname.h:35,
    from init/main.c:20:
    include/linux/sched.h: In function 'arch_pick_mmap_layout':
    include/linux/sched.h:2149: error: implicit declaration of function 'PAGE_ALIGN'

    Reported-by: Adrian Bunk
    Cc: Haavard Skinnemoen
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Andrew Morton
     

15 Nov, 2007

1 commit

  • Commit ef8b4520bd9f8294ffce9abd6158085bde5dc902 added one NULL check for
    "p" in krealloc(), but that doesn't seem to be enough since there
    doesn't seem to be any guarantee that memcpy(ret, NULL, 0) works
    (spotted by the Coverity checker).

    For making it clearer what happens this patch also removes the pointless
    min().

    Signed-off-by: Adrian Bunk
    Acked-by: Christoph Lameter
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Adrian Bunk
     

17 Oct, 2007

1 commit

  • A NULL pointer means that the object was not allocated. One cannot
    determine the size of an object that has not been allocated. Currently we
    return 0 but we really should BUG() on attempts to determine the size of
    something nonexistent.

    krealloc() interprets NULL to mean a zero sized object. Handle that
    separately in krealloc().

    Signed-off-by: Christoph Lameter
    Acked-by: Pekka Enberg
    Cc: Matt Mackall
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Christoph Lameter
     

18 Jul, 2007

4 commits

  • Add a kstrndup function, modelled on strndup. Like strndup this
    returns a string copied into its own allocated memory, but it copies
    no more than the specified number of bytes from the source.

    Remove private strndup() from irda code.

    Signed-off-by: Jeremy Fitzhardinge
    Signed-off-by: Chris Wright
    Cc: Andrew Morton
    Cc: Randy Dunlap
    Cc: YOSHIFUJI Hideaki
    Cc: Akinobu Mita
    Cc: Arnaldo Carvalho de Melo
    Cc: Al Viro
    Cc: Panagiotis Issaris
    Cc: Rene Scharfe

    Jeremy Fitzhardinge
     
  • It becomes now easy to support the zeroing allocs with generic inline
    functions in slab.h. Provide inline definitions to allow the continued use of
    kzalloc, kmem_cache_zalloc etc but remove other definitions of zeroing
    functions from the slab allocators and util.c.

    Signed-off-by: Christoph Lameter
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Christoph Lameter
     
  • Define ZERO_OR_NULL_PTR macro to be able to remove the checks from the
    allocators. Move ZERO_SIZE_PTR related stuff into slab.h.

    Make ZERO_SIZE_PTR work for all slab allocators and get rid of the
    WARN_ON_ONCE(size == 0) that is still remaining in SLAB.

    Make slub return NULL like the other allocators if a too large memory segment
    is requested via __kmalloc.

    Signed-off-by: Christoph Lameter
    Acked-by: Pekka Enberg
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Christoph Lameter
     
  • The size of a kmalloc object is readily available via ksize(). ksize is
    provided by all allocators and thus we can implement krealloc in a generic
    way.

    Implement krealloc in mm/util.c and drop slab specific implementations of
    krealloc.

    Signed-off-by: Christoph Lameter
    Acked-by: Pekka Enberg
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Christoph Lameter
     

04 Oct, 2006

1 commit

  • - rename ____kmalloc to kmalloc_track_caller so that people have a chance
    to guess what it does just from it's name. Add a comment describing it
    for those who don't. Also move it after kmalloc in slab.h so people get
    less confused when they are just looking for kmalloc - move things around
    in slab.c a little to reduce the ifdef mess.

    [penberg@cs.helsinki.fi: Fix up reversed #ifdef]
    Signed-off-by: Christoph Hellwig
    Signed-off-by: Pekka Enberg
    Cc: Christoph Lameter
    Cc: Al Viro
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Christoph Hellwig
     

01 Oct, 2006

1 commit

  • One of idiomatic ways to duplicate a region of memory is

    dst = kmalloc(len, GFP_KERNEL);
    if (!dst)
    return -ENOMEM;
    memcpy(dst, src, len);

    which is neat code except a programmer needs to write size twice. Which
    sometimes leads to mistakes. If len passed to kmalloc is smaller that len
    passed to memcpy, it's straight overwrite-beyond-end. If len passed to
    memcpy is smaller than len passed to kmalloc, it's either a) legit
    behaviour ;-), or b) cloned buffer will contain garbage in second half.

    Slight trolling of commit lists shows several duplications bugs
    done exactly because of diverged lenghts:

    Linux:
    [CRYPTO]: Fix memcpy/memset args.
    [PATCH] memcpy/memset fixes
    OpenBSD:
    kerberosV/src/lib/asn1: der_copy.c:1.4

    If programmer is given only one place to play with lengths, I believe, such
    mistakes could be avoided.

    With kmemdup, the snippet above will be rewritten as:

    dst = kmemdup(src, len, GFP_KERNEL);
    if (!dst)
    return -ENOMEM;

    This also leads to smaller code (kzalloc effect). Quick grep shows
    200+ places where kmemdup() can be used.

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexey Dobriyan
     

26 Mar, 2006

2 commits

  • As suggested by Eric Dumazet, optimize kzalloc() calls that pass a
    compile-time constant size. Please note that the patch increases kernel
    text slightly (~200 bytes for defconfig on x86).

    Signed-off-by: Pekka Enberg
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Pekka Enberg
     
  • Implement /proc/slab_allocators. It produces output like:

    idr_layer_cache: 80 idr_pre_get+0x33/0x4e
    buffer_head: 2555 alloc_buffer_head+0x20/0x75
    mm_struct: 9 mm_alloc+0x1e/0x42
    mm_struct: 20 dup_mm+0x36/0x370
    vm_area_struct: 384 dup_mm+0x18f/0x370
    vm_area_struct: 151 do_mmap_pgoff+0x2e0/0x7c3
    vm_area_struct: 1 split_vma+0x5a/0x10e
    vm_area_struct: 11 do_brk+0x206/0x2e2
    vm_area_struct: 2 copy_vma+0xda/0x142
    vm_area_struct: 9 setup_arg_pages+0x99/0x214
    fs_cache: 8 copy_fs_struct+0x21/0x133
    fs_cache: 29 copy_process+0xf38/0x10e3
    files_cache: 30 alloc_files+0x1b/0xcf
    signal_cache: 81 copy_process+0xbaa/0x10e3
    sighand_cache: 77 copy_process+0xe65/0x10e3
    sighand_cache: 1 de_thread+0x4d/0x5f8
    anon_vma: 241 anon_vma_prepare+0xd9/0xf3
    size-2048: 1 add_sect_attrs+0x5f/0x145
    size-2048: 2 journal_init_revoke+0x99/0x302
    size-2048: 2 journal_init_revoke+0x137/0x302
    size-2048: 2 journal_init_inode+0xf9/0x1c4

    Cc: Manfred Spraul
    Cc: Alexander Nyberg
    Cc: Pekka Enberg
    Cc: Christoph Lameter
    Cc: Ravikiran Thirumalai
    Signed-off-by: Al Viro
    DESC
    slab-leaks3-locking-fix
    EDESC
    From: Andrew Morton

    Update for slab-remove-cachep-spinlock.patch

    Cc: Al Viro
    Cc: Manfred Spraul
    Cc: Alexander Nyberg
    Cc: Pekka Enberg
    Cc: Christoph Lameter
    Cc: Ravikiran Thirumalai
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Al Viro
     

24 Mar, 2006

1 commit

  • This patch series creates a strndup_user() function to easy copying C strings
    from userspace. Also we avoid common pitfalls like userspace modifying the
    final \0 after the strlen_user().

    Signed-off-by: Davi Arnaut
    Cc: David Howells
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Davi Arnaut
     

09 Jan, 2006

1 commit