diff mbox series

[06/26] dma-buf: system_heap: use array_size

Message ID	20230623211457.102544-7-Julia.Lawall@inria.fr
State	New
Headers	Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; From: Julia Lawall <Julia.Lawall@inria.fr> To: Sumit Semwal <sumit.semwal@linaro.org> Cc: keescook@chromium.org, kernel-janitors@vger.kernel.org, Benjamin Gaignard <benjamin.gaignard@collabora.com>, Liam Mark <lmark@codeaurora.org>, Laura Abbott <labbott@redhat.com>, Brian Starkey <Brian.Starkey@arm.com>, John Stultz <jstultz@google.com>, =?utf-8?q?Christian_K=C3=B6nig?= <christian.koenig@amd.com>, linux-media@vger.kernel.org, dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org Subject: [PATCH 06/26] dma-buf: system_heap: use array_size Date: Fri, 23 Jun 2023 23:14:37 +0200 Message-Id: <20230623211457.102544-7-Julia.Lawall@inria.fr> In-Reply-To: <20230623211457.102544-1-Julia.Lawall@inria.fr> References: <20230623211457.102544-1-Julia.Lawall@inria.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	use array_size \| [00/26] use array_size [01/26] lib/test_vmalloc.c: use array_size [02/26] octeon_ep: use array_size [03/26] drm/gud: use array_size [04/26] gve: use array_size [05/26] RDMA/erdma: use array_size [06/26] dma-buf: system_heap: use array_size [07/26] scsi: fnic: use array_size [08/26] virtio-mem: use array_size [09/26] pds_core: use array_size [10/26] bus: mhi: host: use array_size [11/26] ionic: use array_size [12/26] btrfs: zoned: use array_size [13/26] iommu/tegra: gart: use array_size [14/26] RDMA/siw: use array_size [15/26] habanalabs: use array_size [16/26] drm/i915/gvt: use array_size [17/26] kcov: use array_size [18/26] net: enetc: use array_size [19/26] RDMA/bnxt_re: use array_size [20/26] drm/vmwgfx: use array_size [21/26] x86/sgx: use array_size [22/26] net: mana: use array_size [23/26] media: staging: imgu: use array_size [24/26] scsi: qla2xxx: use array_size [25/26] vduse: use array_size [26/26] comedi: use array_size

Commit Message

Julia Lawall June 23, 2023, 9:14 p.m. UTC

  Use array_size to protect against multiplication overflows.

The changes were done using the following Coccinelle semantic patch:

// <smpl>
@@
    size_t e1,e2;
    expression COUNT;
    identifier alloc = {vmalloc,vzalloc,kvmalloc,kvzalloc};
@@

(
      alloc(
-           (e1) * (e2)
+           array_size(e1, e2)
      ,...)
|
      alloc(
-           (e1) * (COUNT)
+           array_size(COUNT, e1)
      ,...)
)
// </smpl>

Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>

---
 drivers/dma-buf/heaps/system_heap.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

John Stultz June 23, 2023, 9:42 p.m. UTC | #1

On Fri, Jun 23, 2023 at 2:15 PM Julia Lawall <Julia.Lawall@inria.fr> wrote:
>
> Use array_size to protect against multiplication overflows.
>
> The changes were done using the following Coccinelle semantic patch:
>
> // <smpl>
> @@
>     size_t e1,e2;
>     expression COUNT;
>     identifier alloc = {vmalloc,vzalloc,kvmalloc,kvzalloc};
> @@
>
> (
>       alloc(
> -           (e1) * (e2)
> +           array_size(e1, e2)
>       ,...)
> |
>       alloc(
> -           (e1) * (COUNT)
> +           array_size(COUNT, e1)
>       ,...)
> )
> // </smpl>
>
> Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>

Thanks for sending this out!

Acked-by: John Stultz <jstultz@google.com>

diff mbox series

Patch

diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c
index ee7059399e9c..fb7867599874 100644
--- a/drivers/dma-buf/heaps/system_heap.c
+++ b/drivers/dma-buf/heaps/system_heap.c
@@ -221,7 +221,7 @@  static void *system_heap_do_vmap(struct system_heap_buffer *buffer)
 {
 	struct sg_table *table = &buffer->sg_table;
 	int npages = PAGE_ALIGN(buffer->len) / PAGE_SIZE;
-	struct page **pages = vmalloc(sizeof(struct page *) * npages);
+	struct page **pages = vmalloc(array_size(npages, sizeof(struct page *)));
 	struct page **tmp = pages;
 	struct sg_page_iter piter;
 	void *vaddr;