aboutsummaryrefslogtreecommitdiffstats
path: root/include/linux/flex_array.h
diff options
context:
space:
mode:
authorDavid Rientjes <rientjes@google.com>2009-08-26 17:29:22 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2009-08-26 23:06:52 -0400
commitb62e408c05228f40e69bb38a48db8961cac6cd23 (patch)
tree40711bad4a60adb8f331d71574ec61e13c5a352d /include/linux/flex_array.h
parent8e7ee27095aee87b5db1b0061e2ceea5878a1bbd (diff)
flex_array: convert element_nr formals to unsigned
It's problematic to allow signed element_nr's or total's to be passed as part of the flex array API. flex_array_alloc() allows total_nr_elements to be set to a negative quantity, which is obviously erroneous. flex_array_get() and flex_array_put() allows negative array indices in dereferencing an array part, which could address memory mapped before struct flex_array. The fix is to convert all existing element_nr formals to be qualified as unsigned. Existing checks to compare it to total_nr_elements or the max array size based on element_size need not be changed. Signed-off-by: David Rientjes <rientjes@google.com> Cc: Dave Hansen <dave@linux.vnet.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/linux/flex_array.h')
-rw-r--r--include/linux/flex_array.h10
1 files changed, 6 insertions, 4 deletions
diff --git a/include/linux/flex_array.h b/include/linux/flex_array.h
index 603160db7c98..45ff18491514 100644
--- a/include/linux/flex_array.h
+++ b/include/linux/flex_array.h
@@ -36,12 +36,14 @@ struct flex_array {
36 .total_nr_elements = (total), \ 36 .total_nr_elements = (total), \
37} } } 37} } }
38 38
39struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags); 39struct flex_array *flex_array_alloc(int element_size, unsigned int total,
40int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags); 40 gfp_t flags);
41int flex_array_prealloc(struct flex_array *fa, unsigned int start,
42 unsigned int end, gfp_t flags);
41void flex_array_free(struct flex_array *fa); 43void flex_array_free(struct flex_array *fa);
42void flex_array_free_parts(struct flex_array *fa); 44void flex_array_free_parts(struct flex_array *fa);
43int flex_array_put(struct flex_array *fa, int element_nr, void *src, 45int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,
44 gfp_t flags); 46 gfp_t flags);
45void *flex_array_get(struct flex_array *fa, int element_nr); 47void *flex_array_get(struct flex_array *fa, unsigned int element_nr);
46 48
47#endif /* _FLEX_ARRAY_H */ 49#endif /* _FLEX_ARRAY_H */