aboutsummaryrefslogtreecommitdiffstats
path: root/lib
diff options
context:
space:
mode:
authorDavid Rientjes <rientjes@google.com>2009-08-26 17:29:22 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2009-08-26 23:06:52 -0400
commitb62e408c05228f40e69bb38a48db8961cac6cd23 (patch)
tree40711bad4a60adb8f331d71574ec61e13c5a352d /lib
parent8e7ee27095aee87b5db1b0061e2ceea5878a1bbd (diff)
flex_array: convert element_nr formals to unsigned
It's problematic to allow signed element_nr's or total's to be passed as part of the flex array API. flex_array_alloc() allows total_nr_elements to be set to a negative quantity, which is obviously erroneous. flex_array_get() and flex_array_put() allows negative array indices in dereferencing an array part, which could address memory mapped before struct flex_array. The fix is to convert all existing element_nr formals to be qualified as unsigned. Existing checks to compare it to total_nr_elements or the max array size based on element_size need not be changed. Signed-off-by: David Rientjes <rientjes@google.com> Cc: Dave Hansen <dave@linux.vnet.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'lib')
-rw-r--r--lib/flex_array.c24
1 files changed, 13 insertions, 11 deletions
diff --git a/lib/flex_array.c b/lib/flex_array.c
index cf4e372cae90..7baed2fc3bc8 100644
--- a/lib/flex_array.c
+++ b/lib/flex_array.c
@@ -99,7 +99,8 @@ static inline int elements_fit_in_base(struct flex_array *fa)
99 * capacity in the base structure. Also note that no effort is made 99 * capacity in the base structure. Also note that no effort is made
100 * to efficiently pack objects across page boundaries. 100 * to efficiently pack objects across page boundaries.
101 */ 101 */
102struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags) 102struct flex_array *flex_array_alloc(int element_size, unsigned int total,
103 gfp_t flags)
103{ 104{
104 struct flex_array *ret; 105 struct flex_array *ret;
105 int max_size = nr_base_part_ptrs() * __elements_per_part(element_size); 106 int max_size = nr_base_part_ptrs() * __elements_per_part(element_size);
@@ -115,7 +116,8 @@ struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags)
115 return ret; 116 return ret;
116} 117}
117 118
118static int fa_element_to_part_nr(struct flex_array *fa, int element_nr) 119static int fa_element_to_part_nr(struct flex_array *fa,
120 unsigned int element_nr)
119{ 121{
120 return element_nr / __elements_per_part(fa->element_size); 122 return element_nr / __elements_per_part(fa->element_size);
121} 123}
@@ -143,14 +145,12 @@ void flex_array_free(struct flex_array *fa)
143 kfree(fa); 145 kfree(fa);
144} 146}
145 147
146static int fa_index_inside_part(struct flex_array *fa, int element_nr) 148static unsigned int index_inside_part(struct flex_array *fa,
149 unsigned int element_nr)
147{ 150{
148 return element_nr % __elements_per_part(fa->element_size); 151 unsigned int part_offset;
149}
150 152
151static int index_inside_part(struct flex_array *fa, int element_nr) 153 part_offset = element_nr % __elements_per_part(fa->element_size);
152{
153 int part_offset = fa_index_inside_part(fa, element_nr);
154 return part_offset * fa->element_size; 154 return part_offset * fa->element_size;
155} 155}
156 156
@@ -185,7 +185,8 @@ __fa_get_part(struct flex_array *fa, int part_nr, gfp_t flags)
185 * 185 *
186 * Locking must be provided by the caller. 186 * Locking must be provided by the caller.
187 */ 187 */
188int flex_array_put(struct flex_array *fa, int element_nr, void *src, gfp_t flags) 188int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,
189 gfp_t flags)
189{ 190{
190 int part_nr = fa_element_to_part_nr(fa, element_nr); 191 int part_nr = fa_element_to_part_nr(fa, element_nr);
191 struct flex_array_part *part; 192 struct flex_array_part *part;
@@ -217,7 +218,8 @@ int flex_array_put(struct flex_array *fa, int element_nr, void *src, gfp_t flags
217 * 218 *
218 * Locking must be provided by the caller. 219 * Locking must be provided by the caller.
219 */ 220 */
220int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags) 221int flex_array_prealloc(struct flex_array *fa, unsigned int start,
222 unsigned int end, gfp_t flags)
221{ 223{
222 int start_part; 224 int start_part;
223 int end_part; 225 int end_part;
@@ -248,7 +250,7 @@ int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags)
248 * 250 *
249 * Locking must be provided by the caller. 251 * Locking must be provided by the caller.
250 */ 252 */
251void *flex_array_get(struct flex_array *fa, int element_nr) 253void *flex_array_get(struct flex_array *fa, unsigned int element_nr)
252{ 254{
253 int part_nr = fa_element_to_part_nr(fa, element_nr); 255 int part_nr = fa_element_to_part_nr(fa, element_nr);
254 struct flex_array_part *part; 256 struct flex_array_part *part;