Eric Lee / smarc-fsl-linux-kernel

05 Mar, 2020

1 commit

  • 5306d0c41   net: netlink: cap max groups which will be considered in netlink_bind() ... Browse Code »

    commit 3a20773beeeeadec41477a5ba872175b778ff752 upstream.

    Since nl_groups is a u32 we can't bind more groups via ->bind
    (netlink_bind) call, but netlink has supported more groups via
    setsockopt() for a long time and thus nlk->ngroups could be over 32.
    Recently I added support for per-vlan notifications and increased the
    groups to 33 for NETLINK_ROUTE which exposed an old bug in the
    netlink_bind() code causing out-of-bounds access on archs where unsigned
    long is 32 bits via test_bit() on a local variable. Fix this by capping the
    maximum groups in netlink_bind() to BITS_PER_TYPE(u32), effectively
    capping them at 32 which is the minimum of allocated groups and the
    maximum groups which can be bound via netlink_bind().

    CC: Christophe Leroy
    CC: Richard Guy Briggs
    Fixes: 4f520900522f ("netlink: have netlink per-protocol bind function return an error code.")
    Reported-by: Erhard F.
    Signed-off-by: Nikolay Aleksandrov
    Signed-off-by: David S. Miller
    Signed-off-by: Greg Kroah-Hartman

    Nikolay Aleksandrov
     

15 Jun, 2019

1 commit

  • 3e1894333   net: remove empty netlink_tap_exit_net ... Browse Code »

    Pointer members of an object with static storage duration, if not
    explicitly initialized, will be initialized to a NULL pointer. The
    net namespace API checks if this pointer is not NULL before using it,
    it are safe to remove the function.

    Signed-off-by: Li RongQing
    Signed-off-by: David S. Miller

    Li RongQing
     

12 Jun, 2019

1 commit

31 May, 2019

1 commit

  • 2874c5fd2   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 ... Browse Code »

    Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation either version 2 of the license or at
    your option any later version

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-or-later

    has been chosen to replace the boilerplate/reference in 3029 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Allison Randal
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190527070032.746973796@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

22 May, 2019

1 commit

  • 2c1212de6   Merge tag 'spdx-5.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core ... Browse Code »

    Pull SPDX update from Greg KH:
    "Here is a series of patches that add SPDX tags to different kernel
    files, based on two different things:

    - SPDX entries are added to a bunch of files that we missed a year
    ago that do not have any license information at all.

    These were either missed because the tool saw the MODULE_LICENSE()
    tag, or some EXPORT_SYMBOL tags, and got confused and thought the
    file had a real license, or the files have been added since the
    last big sweep, or they were Makefile/Kconfig files, which we
    didn't touch last time.

    - Add GPL-2.0-only or GPL-2.0-or-later tags to files where our scan
    tools can determine the license text in the file itself. Where this
    happens, the license text is removed, in order to cut down on the
    700+ different ways we have in the kernel today, in a quest to get
    rid of all of these.

    These patches have been out for review on the linux-spdx@vger mailing
    list, and while they were created by automatic tools, they were
    hand-verified by a bunch of different people, all whom names are on
    the patches are reviewers.

    The reason for these "large" patches is if we were to continue to
    progress at the current rate of change in the kernel, adding license
    tags to individual files in different subsystems, we would be finished
    in about 10 years at the earliest.

    There will be more series of these types of patches coming over the
    next few weeks as the tools and reviewers crunch through the more
    "odd" variants of how to say "GPLv2" that developers have come up with
    over the years, combined with other fun oddities (GPL + a BSD
    disclaimer?) that are being unearthed, with the goal for the whole
    kernel to be cleaned up.

    These diffstats are not small, 3840 files are touched, over 10k lines
    removed in just 24 patches"

    * tag 'spdx-5.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (24 commits)
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 25
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 24
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 23
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 22
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 21
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 20
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 19
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 18
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 17
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 15
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 14
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 12
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 11
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 10
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 9
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 7
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 5
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 4
    treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 3
    ...

    Linus Torvalds
     

21 May, 2019

2 commits

20 May, 2019

1 commit

04 May, 2019

1 commit

  • 05d7f547b   genetlink: do not validate dump requests if there is no policy ... Browse Code »

    Unlike do requests, dump genetlink requests now perform strict validation
    by default even if the genetlink family does not set policy and maxtype
    because it does validation and parsing on its own (e.g. because it wants to
    allow different message format for different commands). While the null
    policy will be ignored, maxtype (which would be zero) is still checked so
    that any attribute will fail validation.

    The solution is to only call __nla_validate() from genl_family_rcv_msg()
    if family->maxtype is set.

    Fixes: ef6243acb478 ("genetlink: optionally validate strictly/dumps")
    Signed-off-by: Michal Kubecek
    Reviewed-by: Johannes Berg
    Signed-off-by: David S. Miller

    Michal Kubecek
     

03 May, 2019

1 commit

28 Apr, 2019

3 commits

  • ef6243acb   genetlink: optionally validate strictly/dumps ... Browse Code »

    Add options to strictly validate messages and dump messages,
    sometimes perhaps validating dump messages non-strictly may
    be required, so add an option for that as well.

    Since none of this can really be applied to existing commands,
    set the options everwhere using the following spatch:

    @@
    identifier ops;
    expression X;
    @@
    struct genl_ops ops[] = {
    ...,
    {
    .cmd = X,
    + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    ...
    },
    ...
    };

    For new commands one should just not copy the .validate 'opt-out'
    flags and thus get strict validation.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • 8cb081746   netlink: make validation more configurable for future strictness ... Browse Code »

    We currently have two levels of strict validation:

    1) liberal (default)
    - undefined (type >= max) & NLA_UNSPEC attributes accepted
    - attribute length >= expected accepted
    - garbage at end of message accepted
    2) strict (opt-in)
    - NLA_UNSPEC attributes accepted
    - attribute length >= expected accepted

    Split out parsing strictness into four different options:
    * TRAILING - check that there's no trailing data after parsing
    attributes (in message or nested)
    * MAXTYPE - reject attrs > max known type
    * UNSPEC - reject attributes with NLA_UNSPEC policy entries
    * STRICT_ATTRS - strictly validate attribute size

    The default for future things should be *everything*.
    The current *_strict() is a combination of TRAILING and MAXTYPE,
    and is renamed to _deprecated_strict().
    The current regular parsing has none of this, and is renamed to
    *_parse_deprecated().

    Additionally it allows us to selectively set one of the new flags
    even on old policies. Notably, the UNSPEC flag could be useful in
    this case, since it can be arranged (by filling in the policy) to
    not be an incompatible userspace ABI change, but would then going
    forward prevent forgetting attribute entries. Similar can apply
    to the POLICY flag.

    We end up with the following renames:
    * nla_parse -> nla_parse_deprecated
    * nla_parse_strict -> nla_parse_deprecated_strict
    * nlmsg_parse -> nlmsg_parse_deprecated
    * nlmsg_parse_strict -> nlmsg_parse_deprecated_strict
    * nla_parse_nested -> nla_parse_nested_deprecated
    * nla_validate_nested -> nla_validate_nested_deprecated

    Using spatch, of course:
    @@
    expression TB, MAX, HEAD, LEN, POL, EXT;
    @@
    -nla_parse(TB, MAX, HEAD, LEN, POL, EXT)
    +nla_parse_deprecated(TB, MAX, HEAD, LEN, POL, EXT)

    @@
    expression NLH, HDRLEN, TB, MAX, POL, EXT;
    @@
    -nlmsg_parse(NLH, HDRLEN, TB, MAX, POL, EXT)
    +nlmsg_parse_deprecated(NLH, HDRLEN, TB, MAX, POL, EXT)

    @@
    expression NLH, HDRLEN, TB, MAX, POL, EXT;
    @@
    -nlmsg_parse_strict(NLH, HDRLEN, TB, MAX, POL, EXT)
    +nlmsg_parse_deprecated_strict(NLH, HDRLEN, TB, MAX, POL, EXT)

    @@
    expression TB, MAX, NLA, POL, EXT;
    @@
    -nla_parse_nested(TB, MAX, NLA, POL, EXT)
    +nla_parse_nested_deprecated(TB, MAX, NLA, POL, EXT)

    @@
    expression START, MAX, POL, EXT;
    @@
    -nla_validate_nested(START, MAX, POL, EXT)
    +nla_validate_nested_deprecated(START, MAX, POL, EXT)

    @@
    expression NLH, HDRLEN, MAX, POL, EXT;
    @@
    -nlmsg_validate(NLH, HDRLEN, MAX, POL, EXT)
    +nlmsg_validate_deprecated(NLH, HDRLEN, MAX, POL, EXT)

    For this patch, don't actually add the strict, non-renamed versions
    yet so that it breaks compile if I get it wrong.

    Also, while at it, make nla_validate and nla_parse go down to a
    common __nla_validate_parse() function to avoid code duplication.

    Ultimately, this allows us to have very strict validation for every
    new caller of nla_parse()/nlmsg_parse() etc as re-introduced in the
    next patch, while existing things will continue to work as is.

    In effect then, this adds fully strict validation for any new command.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • ae0be8de9   netlink: make nla_nest_start() add NLA_F_NESTED flag ... Browse Code »

    Even if the NLA_F_NESTED flag was introduced more than 11 years ago, most
    netlink based interfaces (including recently added ones) are still not
    setting it in kernel generated messages. Without the flag, message parsers
    not aware of attribute semantics (e.g. wireshark dissector or libmnl's
    mnl_nlmsg_fprintf()) cannot recognize nested attributes and won't display
    the structure of their contents.

    Unfortunately we cannot just add the flag everywhere as there may be
    userspace applications which check nlattr::nla_type directly rather than
    through a helper masking out the flags. Therefore the patch renames
    nla_nest_start() to nla_nest_start_noflag() and introduces nla_nest_start()
    as a wrapper adding NLA_F_NESTED. The calls which add NLA_F_NESTED manually
    are rewritten to use nla_nest_start().

    Except for changes in include/net/netlink.h, the patch was generated using
    this semantic patch:

    @@ expression E1, E2; @@
    -nla_nest_start(E1, E2)
    +nla_nest_start_noflag(E1, E2)

    @@ expression E1, E2; @@
    -nla_nest_start_noflag(E1, E2 | NLA_F_NESTED)
    +nla_nest_start(E1, E2)

    Signed-off-by: Michal Kubecek
    Acked-by: Jiri Pirko
    Acked-by: David Ahern
    Signed-off-by: David S. Miller

    Michal Kubecek
     

26 Apr, 2019

1 commit

18 Apr, 2019

1 commit

13 Apr, 2019

1 commit

28 Mar, 2019

1 commit

22 Mar, 2019

2 commits

  • 3b0f31f2b   genetlink: make policy common to family ... Browse Code »

    Since maxattr is common, the policy can't really differ sanely,
    so make it common as well.

    The only user that did in fact manage to make a non-common policy
    is taskstats, which has to be really careful about it (since it's
    still using a common maxattr!). This is no longer supported, but
    we can fake it using pre_doit.

    This reduces the size of e.g. nl80211.o (which has lots of commands):

    text data bss dec hex filename
    398745 14323 2240 415308 6564c net/wireless/nl80211.o (before)
    397913 14331 2240 414484 65314 net/wireless/nl80211.o (after)
    --------------------------------
    -832 +8 0 -824

    Which is obviously just 8 bytes for each command, and an added 8
    bytes for the new policy pointer. I'm not sure why the ops list is
    counted as .text though.

    Most of the code transformations were done using the following spatch:
    @ops@
    identifier OPS;
    expression POLICY;
    @@
    struct genl_ops OPS[] = {
    ...,
    {
    - .policy = POLICY,
    },
    ...
    };

    @@
    identifier ops.OPS;
    expression ops.POLICY;
    identifier fam;
    expression M;
    @@
    struct genl_family fam = {
    .ops = OPS,
    .maxattr = M,
    + .policy = POLICY,
    ...
    };

    This also gets rid of devlink_nl_cmd_region_read_dumpit() accessing
    the cb->data as ops, which we want to change in a later genl patch.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • ceabee6c5   genetlink: Fix a memory leak on error path ... Browse Code »

    In genl_register_family(), when idr_alloc() fails,
    we forget to free the memory we possibly allocate for
    family->attrbuf.

    Reported-by: Hulk Robot
    Fixes: 2ae0f17df1cd ("genetlink: use idr to track families")
    Signed-off-by: YueHaibing
    Reviewed-by: Kirill Tkhai
    Signed-off-by: David S. Miller

    YueHaibing
     

22 Feb, 2019

1 commit

20 Jan, 2019

1 commit

15 Dec, 2018

1 commit

16 Oct, 2018

1 commit

  • 22e6c58b8   netlink: Add answer_flags to netlink_callback ... Browse Code »

    With dump filtering we need a way to ensure the NLM_F_DUMP_FILTERED
    flag is set on a message back to the user if the data returned is
    influenced by some input attributes. Normally this can be done as
    messages are added to the skb, but if the filter results in no data
    being returned, the user could be confused as to why.

    This patch adds answer_flags to the netlink_callback allowing dump
    handlers to set the NLM_F_DUMP_FILTERED at a minimum in the
    NLMSG_DONE message ensuring the flag gets back to the user.

    The netlink_callback space is initialized to 0 via a memset in
    __netlink_dump_start, so init of the new answer_flags is covered.

    Signed-off-by: David Ahern
    Signed-off-by: David S. Miller

    David Ahern
     

09 Oct, 2018

2 commits

  • 89d35528d   netlink: Add new socket option to enable strict checking on dumps ... Browse Code »

    Add a new socket option, NETLINK_DUMP_STRICT_CHK, that userspace
    can use via setsockopt to request strict checking of headers and
    attributes on dump requests.

    To get dump features such as kernel side filtering based on data in
    the header or attributes appended to the dump request, userspace
    must call setsockopt() for NETLINK_DUMP_STRICT_CHK and a non-zero
    value. Since the netlink sock and its flags are private to the
    af_netlink code, the strict checking flag is passed to dump handlers
    via a flag in the netlink_callback struct.

    For old userspace on new kernel there is no impact as all of the data
    checks in later patches are wrapped in a check on the new strict flag.

    For new userspace on old kernel, the setsockopt will fail and even if
    new userspace sets data in the headers and appended attributes the
    kernel will silently ignore it. Moving forward when the setsockopt
    succeeds, the new userspace on old kernel means the dump request can
    pass an attribute the kernel does not understand. The dump will then
    fail as the older kernel does not understand it.

    New userspace on new kernel setting the socket option gets the benefit
    of the improved data dump.

    Kernel side the NETLINK_DUMP_STRICT_CHK uapi is converted to a generic
    NETLINK_F_STRICT_CHK flag which can potentially be leveraged for tighter
    checking on the NEW, DEL, and SET commands.

    Signed-off-by: David Ahern
    Acked-by: Christian Brauner
    Signed-off-by: David S. Miller

    David Ahern
     
  • 4a19edb60   netlink: Pass extack to dump handlers ... Browse Code »

    Declare extack in netlink_dump and pass to dump handlers via
    netlink_callback. Add any extack message after the dump_done_errno
    allowing error messages to be returned. This will be useful when
    strict checking is done on dump requests, returning why the dump
    fails EINVAL.

    Signed-off-by: David Ahern
    Acked-by: Christian Brauner
    Signed-off-by: David S. Miller

    David Ahern
     

12 Sep, 2018

1 commit

  • 0041195d5   netlink: remove hash::nelems check in netlink_insert ... Browse Code »

    The type of hash::nelems has been changed from size_t to atom_t
    which in fact is int, so not need to check if BITS_PER_LONG, that
    is bit number of size_t, is bigger than 32

    and rht_grow_above_max() will be called to check if hashtable is
    too big, ensure it can not bigger than 1<
    Signed-off-by: Li RongQing
    Signed-off-by: David S. Miller

    Li RongQing
     

06 Sep, 2018

1 commit

  • 428f944bd   netlink: Make groups check less stupid in netlink_bind() ... Browse Code »

    As Linus noted, the test for 0 is needless, groups type can follow the
    usual kernel style and 8*sizeof(unsigned long) is BITS_PER_LONG:

    > The code [..] isn't technically incorrect...
    > But it is stupid.
    > Why stupid? Because the test for 0 is pointless.
    >
    > Just doing
    > if (nlk->ngroups < 8*sizeof(groups))
    > groups &= (1UL << nlk->ngroups) - 1;
    >
    > would have been fine and more understandable, since the "mask by shift
    > count" already does the right thing for a ngroups value of 0. Now that
    > test for zero makes me go "what's special about zero?". It turns out
    > that the answer to that is "nothing".
    [..]
    > The type of "groups" is kind of silly too.
    >
    > Yeah, "long unsigned int" isn't _technically_ wrong. But we normally
    > call that type "unsigned long".

    Cleanup my piece of pointlessness.

    Cc: "David S. Miller"
    Cc: Herbert Xu
    Cc: Steffen Klassert
    Cc: netdev@vger.kernel.org
    Fairly-blamed-by: Linus Torvalds
    Signed-off-by: Dmitry Safonov
    Signed-off-by: David S. Miller

    Dmitry Safonov
     

06 Aug, 2018

1 commit

05 Aug, 2018

1 commit

  • 91874ecf3   netlink: Don't shift on 64 for ngroups ... Browse Code »

    It's legal to have 64 groups for netlink_sock.

    As user-supplied nladdr->nl_groups is __u32, it's possible to subscribe
    only to first 32 groups.

    The check for correctness of .bind() userspace supplied parameter
    is done by applying mask made from ngroups shift. Which broke Android
    as they have 64 groups and the shift for mask resulted in an overflow.

    Fixes: 61f4b23769f0 ("netlink: Don't shift with UB on nlk->ngroups")
    Cc: "David S. Miller"
    Cc: Herbert Xu
    Cc: Steffen Klassert
    Cc: netdev@vger.kernel.org
    Cc: stable@vger.kernel.org
    Reported-and-Tested-by: Nathan Chancellor
    Signed-off-by: Dmitry Safonov
    Signed-off-by: David S. Miller

    Dmitry Safonov
     

03 Aug, 2018

1 commit

02 Aug, 2018

1 commit

  • bc5b6c0b6   netlink: Fix spectre v1 gadget in netlink_create() ... Browse Code »

    'protocol' is a user-controlled value, so sanitize it after the bounds
    check to avoid using it for speculative out-of-bounds access to arrays
    indexed by it.

    This addresses the following accesses detected with the help of smatch:

    * net/netlink/af_netlink.c:654 __netlink_create() warn: potential
    spectre issue 'nlk_cb_mutex_keys' [w]

    * net/netlink/af_netlink.c:654 __netlink_create() warn: potential
    spectre issue 'nlk_cb_mutex_key_strings' [w]

    * net/netlink/af_netlink.c:685 netlink_create() warn: potential spectre
    issue 'nl_table' [w] (local cap)

    Cc: Josh Poimboeuf
    Signed-off-by: Jeremy Cline
    Reviewed-by: Josh Poimboeuf
    Signed-off-by: David S. Miller

    Jeremy Cline
     

31 Jul, 2018

1 commit

  • 61f4b2376   netlink: Don't shift with UB on nlk->ngroups ... Browse Code »

    On i386 nlk->ngroups might be 32 or 0. Which leads to UB, resulting in
    hang during boot.
    Check for 0 ngroups and use (unsigned long long) as a type to shift.

    Fixes: 7acf9d4237c4 ("netlink: Do not subscribe to non-existent groups").
    Reported-by: kernel test robot
    Signed-off-by: Dmitry Safonov
    Signed-off-by: David S. Miller

    Dmitry Safonov
     

30 Jul, 2018

1 commit

  • 7acf9d423   netlink: Do not subscribe to non-existent groups ... Browse Code »

    Make ABI more strict about subscribing to group > ngroups.
    Code doesn't check for that and it looks bogus.
    (one can subscribe to non-existing group)
    Still, it's possible to bind() to all possible groups with (-1)

    Cc: "David S. Miller"
    Cc: Herbert Xu
    Cc: Steffen Klassert
    Cc: netdev@vger.kernel.org
    Signed-off-by: Dmitry Safonov
    Signed-off-by: David S. Miller

    Dmitry Safonov
     

25 Jul, 2018

1 commit

29 Jun, 2018

1 commit

  • a11e1d432   Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL ... Browse Code »

    The poll() changes were not well thought out, and completely
    unexplained. They also caused a huge performance regression, because
    "->poll()" was no longer a trivial file operation that just called down
    to the underlying file operations, but instead did at least two indirect
    calls.

    Indirect calls are sadly slow now with the Spectre mitigation, but the
    performance problem could at least be largely mitigated by changing the
    "->get_poll_head()" operation to just have a per-file-descriptor pointer
    to the poll head instead. That gets rid of one of the new indirections.

    But that doesn't fix the new complexity that is completely unwarranted
    for the regular case. The (undocumented) reason for the poll() changes
    was some alleged AIO poll race fixing, but we don't make the common case
    slower and more complex for some uncommon special case, so this all
    really needs way more explanations and most likely a fundamental
    redesign.

    [ This revert is a revert of about 30 different commits, not reverted
    individually because that would just be unnecessarily messy - Linus ]

    Cc: Al Viro
    Cc: Christoph Hellwig
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

13 Jun, 2018

1 commit

  • 6da2ec560   treewide: kmalloc() -> kmalloc_array() ... Browse Code »

    The kmalloc() function has a 2-factor argument form, kmalloc_array(). This
    patch replaces cases of:

    kmalloc(a * b, gfp)

    with:
    kmalloc_array(a * b, gfp)

    as well as handling cases of:

    kmalloc(a * b * c, gfp)

    with:

    kmalloc(array3_size(a, b, c), gfp)

    as it's slightly less ugly than:

    kmalloc_array(array_size(a, b), c, gfp)

    This does, however, attempt to ignore constant size factors like:

    kmalloc(4 * 1024, gfp)

    though any constants defined via macros get caught up in the conversion.

    Any factors with a sizeof() of "unsigned char", "char", and "u8" were
    dropped, since they're redundant.

    The tools/ directory was manually excluded, since it has its own
    implementation of kmalloc().

    The Coccinelle script used for this was:

    // Fix redundant parens around sizeof().
    @@
    type TYPE;
    expression THING, E;
    @@

    (
    kmalloc(
    - (sizeof(TYPE)) * E
    + sizeof(TYPE) * E
    , ...)
    |
    kmalloc(
    - (sizeof(THING)) * E
    + sizeof(THING) * E
    , ...)
    )

    // Drop single-byte sizes and redundant parens.
    @@
    expression COUNT;
    typedef u8;
    typedef __u8;
    @@

    (
    kmalloc(
    - sizeof(u8) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(__u8) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(char) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(unsigned char) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(u8) * COUNT
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(__u8) * COUNT
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(char) * COUNT
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(unsigned char) * COUNT
    + COUNT
    , ...)
    )

    // 2-factor product with sizeof(type/expression) and identifier or constant.
    @@
    type TYPE;
    expression THING;
    identifier COUNT_ID;
    constant COUNT_CONST;
    @@

    (
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * (COUNT_ID)
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * COUNT_ID
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * (COUNT_CONST)
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * COUNT_CONST
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * (COUNT_ID)
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * COUNT_ID
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * (COUNT_CONST)
    + COUNT_CONST, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * COUNT_CONST
    + COUNT_CONST, sizeof(THING)
    , ...)
    )

    // 2-factor product, only identifiers.
    @@
    identifier SIZE, COUNT;
    @@

    - kmalloc
    + kmalloc_array
    (
    - SIZE * COUNT
    + COUNT, SIZE
    , ...)

    // 3-factor product with 1 sizeof(type) or sizeof(expression), with
    // redundant parens removed.
    @@
    expression THING;
    identifier STRIDE, COUNT;
    type TYPE;
    @@

    (
    kmalloc(
    - sizeof(TYPE) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    )

    // 3-factor product with 2 sizeof(variable), with redundant parens removed.
    @@
    expression THING1, THING2;
    identifier COUNT;
    type TYPE1, TYPE2;
    @@

    (
    kmalloc(
    - sizeof(TYPE1) * sizeof(TYPE2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kmalloc(
    - sizeof(THING1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kmalloc(
    - sizeof(THING1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    )

    // 3-factor product, only identifiers, with redundant parens removed.
    @@
    identifier STRIDE, SIZE, COUNT;
    @@

    (
    kmalloc(
    - (COUNT) * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - (COUNT) * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - (COUNT) * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - (COUNT) * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    )

    // Any remaining multi-factor products, first at least 3-factor products,
    // when they're not all constants...
    @@
    expression E1, E2, E3;
    constant C1, C2, C3;
    @@

    (
    kmalloc(C1 * C2 * C3, ...)
    |
    kmalloc(
    - (E1) * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kmalloc(
    - (E1) * (E2) * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kmalloc(
    - (E1) * (E2) * (E3)
    + array3_size(E1, E2, E3)
    , ...)
    |
    kmalloc(
    - E1 * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    )

    // And then all remaining 2 factors products when they're not all constants,
    // keeping sizeof() as the second factor argument.
    @@
    expression THING, E1, E2;
    type TYPE;
    constant C1, C2, C3;
    @@

    (
    kmalloc(sizeof(THING) * C2, ...)
    |
    kmalloc(sizeof(TYPE) * C2, ...)
    |
    kmalloc(C1 * C2 * C3, ...)
    |
    kmalloc(C1 * C2, ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * (E2)
    + E2, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * E2
    + E2, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * (E2)
    + E2, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * E2
    + E2, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - (E1) * E2
    + E1, E2
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - (E1) * (E2)
    + E1, E2
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - E1 * E2
    + E1, E2
    , ...)
    )

    Signed-off-by: Kees Cook

    Kees Cook
     

05 Jun, 2018

1 commit

  • 408afb8d7   Merge branch 'work.aio-1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Browse Code »

    Pull aio updates from Al Viro:
    "Majority of AIO stuff this cycle. aio-fsync and aio-poll, mostly.

    The only thing I'm holding back for a day or so is Adam's aio ioprio -
    his last-minute fixup is trivial (missing stub in !CONFIG_BLOCK case),
    but let it sit in -next for decency sake..."

    * 'work.aio-1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (46 commits)
    aio: sanitize the limit checking in io_submit(2)
    aio: fold do_io_submit() into callers
    aio: shift copyin of iocb into io_submit_one()
    aio_read_events_ring(): make a bit more readable
    aio: all callers of aio_{read,write,fsync,poll} treat 0 and -EIOCBQUEUED the same way
    aio: take list removal to (some) callers of aio_complete()
    aio: add missing break for the IOCB_CMD_FDSYNC case
    random: convert to ->poll_mask
    timerfd: convert to ->poll_mask
    eventfd: switch to ->poll_mask
    pipe: convert to ->poll_mask
    crypto: af_alg: convert to ->poll_mask
    net/rxrpc: convert to ->poll_mask
    net/iucv: convert to ->poll_mask
    net/phonet: convert to ->poll_mask
    net/nfc: convert to ->poll_mask
    net/caif: convert to ->poll_mask
    net/bluetooth: convert to ->poll_mask
    net/sctp: convert to ->poll_mask
    net/tipc: convert to ->poll_mask
    ...

    Linus Torvalds
     

26 May, 2018

1 commit

16 May, 2018

1 commit

  • c35063722   proc: introduce proc_create_net{,_data} ... Browse Code »

    Variants of proc_create{,_data} that directly take a struct seq_operations
    and deal with network namespaces in ->open and ->release. All callers of
    proc_create + seq_open_net converted over, and seq_{open,release}_net are
    removed entirely.

    Signed-off-by: Christoph Hellwig

    Christoph Hellwig
     

05 May, 2018

1 commit