![Kees Cook](/assets/img/avatar_default.png)
The kmalloc() function has a 2-factor argument form, kmalloc_array(). This patch replaces cases of: kmalloc(a * b, gfp) with: kmalloc_array(a * b, gfp) as well as handling cases of: kmalloc(a * b * c, gfp) with: kmalloc(array3_size(a, b, c), gfp) as it's slightly less ugly than: kmalloc_array(array_size(a, b), c, gfp) This does, however, attempt to ignore constant size factors like: kmalloc(4 * 1024, gfp) though any constants defined via macros get caught up in the conversion. Any factors with a sizeof() of "unsigned char", "char", and "u8" were dropped, since they're redundant. The tools/ directory was manually excluded, since it has its own implementation of kmalloc(). The Coccinelle script used for this was: // Fix redundant parens around sizeof(). @@ type TYPE; expression THING, E; @@ ( kmalloc( - (sizeof(TYPE)) * E + sizeof(TYPE) * E , ...) | kmalloc( - (sizeof(THING)) * E + sizeof(THING) * E , ...) ) // Drop single-byte sizes and redundant parens. @@ expression COUNT; typedef u8; typedef __u8; @@ ( kmalloc( - sizeof(u8) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(__u8) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(char) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(unsigned char) * (COUNT) + COUNT , ...) | kmalloc( - sizeof(u8) * COUNT + COUNT , ...) | kmalloc( - sizeof(__u8) * COUNT + COUNT , ...) | kmalloc( - sizeof(char) * COUNT + COUNT , ...) | kmalloc( - sizeof(unsigned char) * COUNT + COUNT , ...) ) // 2-factor product with sizeof(type/expression) and identifier or constant. @@ type TYPE; expression THING; identifier COUNT_ID; constant COUNT_CONST; @@ ( - kmalloc + kmalloc_array ( - sizeof(TYPE) * (COUNT_ID) + COUNT_ID, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * COUNT_ID + COUNT_ID, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * (COUNT_CONST) + COUNT_CONST, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * COUNT_CONST + COUNT_CONST, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * (COUNT_ID) + COUNT_ID, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * COUNT_ID + COUNT_ID, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * (COUNT_CONST) + COUNT_CONST, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * COUNT_CONST + COUNT_CONST, sizeof(THING) , ...) ) // 2-factor product, only identifiers. @@ identifier SIZE, COUNT; @@ - kmalloc + kmalloc_array ( - SIZE * COUNT + COUNT, SIZE , ...) // 3-factor product with 1 sizeof(type) or sizeof(expression), with // redundant parens removed. @@ expression THING; identifier STRIDE, COUNT; type TYPE; @@ ( kmalloc( - sizeof(TYPE) * (COUNT) * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(TYPE) * (COUNT) * STRIDE + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(TYPE) * COUNT * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(TYPE) * COUNT * STRIDE + array3_size(COUNT, STRIDE, sizeof(TYPE)) , ...) | kmalloc( - sizeof(THING) * (COUNT) * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kmalloc( - sizeof(THING) * (COUNT) * STRIDE + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kmalloc( - sizeof(THING) * COUNT * (STRIDE) + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) | kmalloc( - sizeof(THING) * COUNT * STRIDE + array3_size(COUNT, STRIDE, sizeof(THING)) , ...) ) // 3-factor product with 2 sizeof(variable), with redundant parens removed. @@ expression THING1, THING2; identifier COUNT; type TYPE1, TYPE2; @@ ( kmalloc( - sizeof(TYPE1) * sizeof(TYPE2) * COUNT + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2)) , ...) | kmalloc( - sizeof(TYPE1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2)) , ...) | kmalloc( - sizeof(THING1) * sizeof(THING2) * COUNT + array3_size(COUNT, sizeof(THING1), sizeof(THING2)) , ...) | kmalloc( - sizeof(THING1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(THING1), sizeof(THING2)) , ...) | kmalloc( - sizeof(TYPE1) * sizeof(THING2) * COUNT + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2)) , ...) | kmalloc( - sizeof(TYPE1) * sizeof(THING2) * (COUNT) + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2)) , ...) ) // 3-factor product, only identifiers, with redundant parens removed. @@ identifier STRIDE, SIZE, COUNT; @@ ( kmalloc( - (COUNT) * STRIDE * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * (STRIDE) * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * STRIDE * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - (COUNT) * (STRIDE) * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * (STRIDE) * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - (COUNT) * STRIDE * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - (COUNT) * (STRIDE) * (SIZE) + array3_size(COUNT, STRIDE, SIZE) , ...) | kmalloc( - COUNT * STRIDE * SIZE + array3_size(COUNT, STRIDE, SIZE) , ...) ) // Any remaining multi-factor products, first at least 3-factor products, // when they're not all constants... @@ expression E1, E2, E3; constant C1, C2, C3; @@ ( kmalloc(C1 * C2 * C3, ...) | kmalloc( - (E1) * E2 * E3 + array3_size(E1, E2, E3) , ...) | kmalloc( - (E1) * (E2) * E3 + array3_size(E1, E2, E3) , ...) | kmalloc( - (E1) * (E2) * (E3) + array3_size(E1, E2, E3) , ...) | kmalloc( - E1 * E2 * E3 + array3_size(E1, E2, E3) , ...) ) // And then all remaining 2 factors products when they're not all constants, // keeping sizeof() as the second factor argument. @@ expression THING, E1, E2; type TYPE; constant C1, C2, C3; @@ ( kmalloc(sizeof(THING) * C2, ...) | kmalloc(sizeof(TYPE) * C2, ...) | kmalloc(C1 * C2 * C3, ...) | kmalloc(C1 * C2, ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * (E2) + E2, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(TYPE) * E2 + E2, sizeof(TYPE) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * (E2) + E2, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - sizeof(THING) * E2 + E2, sizeof(THING) , ...) | - kmalloc + kmalloc_array ( - (E1) * E2 + E1, E2 , ...) | - kmalloc + kmalloc_array ( - (E1) * (E2) + E1, E2 , ...) | - kmalloc + kmalloc_array ( - E1 * E2 + E1, E2 , ...) ) Signed-off-by: Kees Cook <keescook@chromium.org>
201 lines
4 KiB
C
201 lines
4 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
#include <linux/ceph/ceph_debug.h>
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/file.h>
|
|
#include <linux/namei.h>
|
|
#include <linux/writeback.h>
|
|
|
|
#include <linux/ceph/libceph.h>
|
|
|
|
/*
|
|
* build a vector of user pages
|
|
*/
|
|
struct page **ceph_get_direct_page_vector(const void __user *data,
|
|
int num_pages, bool write_page)
|
|
{
|
|
struct page **pages;
|
|
int got = 0;
|
|
int rc = 0;
|
|
|
|
pages = kmalloc_array(num_pages, sizeof(*pages), GFP_NOFS);
|
|
if (!pages)
|
|
return ERR_PTR(-ENOMEM);
|
|
|
|
while (got < num_pages) {
|
|
rc = get_user_pages_fast(
|
|
(unsigned long)data + ((unsigned long)got * PAGE_SIZE),
|
|
num_pages - got, write_page, pages + got);
|
|
if (rc < 0)
|
|
break;
|
|
BUG_ON(rc == 0);
|
|
got += rc;
|
|
}
|
|
if (rc < 0)
|
|
goto fail;
|
|
return pages;
|
|
|
|
fail:
|
|
ceph_put_page_vector(pages, got, false);
|
|
return ERR_PTR(rc);
|
|
}
|
|
EXPORT_SYMBOL(ceph_get_direct_page_vector);
|
|
|
|
void ceph_put_page_vector(struct page **pages, int num_pages, bool dirty)
|
|
{
|
|
int i;
|
|
|
|
for (i = 0; i < num_pages; i++) {
|
|
if (dirty)
|
|
set_page_dirty_lock(pages[i]);
|
|
put_page(pages[i]);
|
|
}
|
|
kvfree(pages);
|
|
}
|
|
EXPORT_SYMBOL(ceph_put_page_vector);
|
|
|
|
void ceph_release_page_vector(struct page **pages, int num_pages)
|
|
{
|
|
int i;
|
|
|
|
for (i = 0; i < num_pages; i++)
|
|
__free_pages(pages[i], 0);
|
|
kfree(pages);
|
|
}
|
|
EXPORT_SYMBOL(ceph_release_page_vector);
|
|
|
|
/*
|
|
* allocate a vector new pages
|
|
*/
|
|
struct page **ceph_alloc_page_vector(int num_pages, gfp_t flags)
|
|
{
|
|
struct page **pages;
|
|
int i;
|
|
|
|
pages = kmalloc_array(num_pages, sizeof(*pages), flags);
|
|
if (!pages)
|
|
return ERR_PTR(-ENOMEM);
|
|
for (i = 0; i < num_pages; i++) {
|
|
pages[i] = __page_cache_alloc(flags);
|
|
if (pages[i] == NULL) {
|
|
ceph_release_page_vector(pages, i);
|
|
return ERR_PTR(-ENOMEM);
|
|
}
|
|
}
|
|
return pages;
|
|
}
|
|
EXPORT_SYMBOL(ceph_alloc_page_vector);
|
|
|
|
/*
|
|
* copy user data into a page vector
|
|
*/
|
|
int ceph_copy_user_to_page_vector(struct page **pages,
|
|
const void __user *data,
|
|
loff_t off, size_t len)
|
|
{
|
|
int i = 0;
|
|
int po = off & ~PAGE_MASK;
|
|
int left = len;
|
|
int l, bad;
|
|
|
|
while (left > 0) {
|
|
l = min_t(int, PAGE_SIZE-po, left);
|
|
bad = copy_from_user(page_address(pages[i]) + po, data, l);
|
|
if (bad == l)
|
|
return -EFAULT;
|
|
data += l - bad;
|
|
left -= l - bad;
|
|
po += l - bad;
|
|
if (po == PAGE_SIZE) {
|
|
po = 0;
|
|
i++;
|
|
}
|
|
}
|
|
return len;
|
|
}
|
|
EXPORT_SYMBOL(ceph_copy_user_to_page_vector);
|
|
|
|
void ceph_copy_to_page_vector(struct page **pages,
|
|
const void *data,
|
|
loff_t off, size_t len)
|
|
{
|
|
int i = 0;
|
|
size_t po = off & ~PAGE_MASK;
|
|
size_t left = len;
|
|
|
|
while (left > 0) {
|
|
size_t l = min_t(size_t, PAGE_SIZE-po, left);
|
|
|
|
memcpy(page_address(pages[i]) + po, data, l);
|
|
data += l;
|
|
left -= l;
|
|
po += l;
|
|
if (po == PAGE_SIZE) {
|
|
po = 0;
|
|
i++;
|
|
}
|
|
}
|
|
}
|
|
EXPORT_SYMBOL(ceph_copy_to_page_vector);
|
|
|
|
void ceph_copy_from_page_vector(struct page **pages,
|
|
void *data,
|
|
loff_t off, size_t len)
|
|
{
|
|
int i = 0;
|
|
size_t po = off & ~PAGE_MASK;
|
|
size_t left = len;
|
|
|
|
while (left > 0) {
|
|
size_t l = min_t(size_t, PAGE_SIZE-po, left);
|
|
|
|
memcpy(data, page_address(pages[i]) + po, l);
|
|
data += l;
|
|
left -= l;
|
|
po += l;
|
|
if (po == PAGE_SIZE) {
|
|
po = 0;
|
|
i++;
|
|
}
|
|
}
|
|
}
|
|
EXPORT_SYMBOL(ceph_copy_from_page_vector);
|
|
|
|
/*
|
|
* Zero an extent within a page vector. Offset is relative to the
|
|
* start of the first page.
|
|
*/
|
|
void ceph_zero_page_vector_range(int off, int len, struct page **pages)
|
|
{
|
|
int i = off >> PAGE_SHIFT;
|
|
|
|
off &= ~PAGE_MASK;
|
|
|
|
dout("zero_page_vector_page %u~%u\n", off, len);
|
|
|
|
/* leading partial page? */
|
|
if (off) {
|
|
int end = min((int)PAGE_SIZE, off + len);
|
|
dout("zeroing %d %p head from %d\n", i, pages[i],
|
|
(int)off);
|
|
zero_user_segment(pages[i], off, end);
|
|
len -= (end - off);
|
|
i++;
|
|
}
|
|
while (len >= PAGE_SIZE) {
|
|
dout("zeroing %d %p len=%d\n", i, pages[i], len);
|
|
zero_user_segment(pages[i], 0, PAGE_SIZE);
|
|
len -= PAGE_SIZE;
|
|
i++;
|
|
}
|
|
/* trailing partial page? */
|
|
if (len) {
|
|
dout("zeroing %d %p tail to %d\n", i, pages[i], (int)len);
|
|
zero_user_segment(pages[i], 0, len);
|
|
}
|
|
}
|
|
EXPORT_SYMBOL(ceph_zero_page_vector_range);
|
|
|