Use vmalloc_array and vcalloc to protect against
multiplication overflows.
The changes were done using the following Coccinelle
semantic patch:
// <smpl>
@initialize:ocaml@
@@
let rename alloc =
match alloc with
"vmalloc" -> "vmalloc_array"
| "vzalloc" -> "vcalloc"
| _ -> failwith "unknown"
@@
size_t e1,e2;
constant C1, C2;
expression E1, E2, COUNT, x1, x2, x3;
typedef u8;
typedef __u8;
type t = {u8,__u8,char,unsigned char};
identifier alloc = {vmalloc,vzalloc};
fresh identifier realloc = script:ocaml(alloc) { rename alloc };
@@
(
alloc(x1*x2*x3)
|
alloc(C1 * C2)
|
alloc((sizeof(t)) * (COUNT), ...)
|
- alloc((e1) * (e2))
+ realloc(e1, e2)
|
- alloc((e1) * (COUNT))
+ realloc(COUNT, e1)
|
- alloc((E1) * (E2))
+ realloc(E1, E2)
)
// </smpl>
Signed-off-by: Julia Lawall <[email protected]>
---
v2: Use vmalloc_array and vcalloc instead of array_size.
This also leaves a multiplication of a constant by a sizeof
as is. Two patches are thus dropped from the series.
drivers/accel/habanalabs/common/device.c | 3 ++-
drivers/accel/habanalabs/common/state_dump.c | 7 ++++---
2 files changed, 6 insertions(+), 4 deletions(-)
diff -u -p a/drivers/accel/habanalabs/common/device.c b/drivers/accel/habanalabs/common/device.c
--- a/drivers/accel/habanalabs/common/device.c
+++ b/drivers/accel/habanalabs/common/device.c
@@ -2594,7 +2594,8 @@ static void hl_capture_user_mappings(str
*/
vfree(pgf_info->user_mappings);
pgf_info->user_mappings =
- vzalloc(pgf_info->num_of_user_mappings * sizeof(struct hl_user_mapping));
+ vcalloc(pgf_info->num_of_user_mappings,
+ sizeof(struct hl_user_mapping));
if (!pgf_info->user_mappings) {
pgf_info->num_of_user_mappings = 0;
goto finish;
diff -u -p a/drivers/accel/habanalabs/common/state_dump.c b/drivers/accel/habanalabs/common/state_dump.c
--- a/drivers/accel/habanalabs/common/state_dump.c
+++ b/drivers/accel/habanalabs/common/state_dump.c
@@ -272,7 +272,8 @@ static u32 *hl_state_dump_read_sync_obje
base_addr = sds->props[SP_SYNC_OBJ_BASE_ADDR] +
sds->props[SP_NEXT_SYNC_OBJ_ADDR] * index;
- sync_objects = vmalloc(sds->props[SP_SYNC_OBJ_AMOUNT] * sizeof(u32));
+ sync_objects = vmalloc_array(sds->props[SP_SYNC_OBJ_AMOUNT],
+ sizeof(u32));
if (!sync_objects)
return NULL;
@@ -453,8 +454,8 @@ hl_state_dump_alloc_read_sm_block_monito
s64 base_addr; /* Base addr can be negative */
int i;
- monitors = vmalloc(sds->props[SP_MONITORS_AMOUNT] *
- sizeof(struct hl_mon_state_dump));
+ monitors = vmalloc_array(sds->props[SP_MONITORS_AMOUNT],
+ sizeof(struct hl_mon_state_dump));
if (!monitors)
return NULL;
On Tue, Jun 27, 2023 at 5:44 PM Julia Lawall <[email protected]> wrote:
>
> Use vmalloc_array and vcalloc to protect against
> multiplication overflows.
>
> The changes were done using the following Coccinelle
> semantic patch:
>
> // <smpl>
> @initialize:ocaml@
> @@
>
> let rename alloc =
> match alloc with
> "vmalloc" -> "vmalloc_array"
> | "vzalloc" -> "vcalloc"
> | _ -> failwith "unknown"
>
> @@
> size_t e1,e2;
> constant C1, C2;
> expression E1, E2, COUNT, x1, x2, x3;
> typedef u8;
> typedef __u8;
> type t = {u8,__u8,char,unsigned char};
> identifier alloc = {vmalloc,vzalloc};
> fresh identifier realloc = script:ocaml(alloc) { rename alloc };
> @@
>
> (
> alloc(x1*x2*x3)
> |
> alloc(C1 * C2)
> |
> alloc((sizeof(t)) * (COUNT), ...)
> |
> - alloc((e1) * (e2))
> + realloc(e1, e2)
> |
> - alloc((e1) * (COUNT))
> + realloc(COUNT, e1)
> |
> - alloc((E1) * (E2))
> + realloc(E1, E2)
> )
> // </smpl>
>
> Signed-off-by: Julia Lawall <[email protected]>
>
> ---
> v2: Use vmalloc_array and vcalloc instead of array_size.
> This also leaves a multiplication of a constant by a sizeof
> as is. Two patches are thus dropped from the series.
>
> drivers/accel/habanalabs/common/device.c | 3 ++-
> drivers/accel/habanalabs/common/state_dump.c | 7 ++++---
> 2 files changed, 6 insertions(+), 4 deletions(-)
>
> diff -u -p a/drivers/accel/habanalabs/common/device.c b/drivers/accel/habanalabs/common/device.c
> --- a/drivers/accel/habanalabs/common/device.c
> +++ b/drivers/accel/habanalabs/common/device.c
> @@ -2594,7 +2594,8 @@ static void hl_capture_user_mappings(str
> */
> vfree(pgf_info->user_mappings);
> pgf_info->user_mappings =
> - vzalloc(pgf_info->num_of_user_mappings * sizeof(struct hl_user_mapping));
> + vcalloc(pgf_info->num_of_user_mappings,
> + sizeof(struct hl_user_mapping));
> if (!pgf_info->user_mappings) {
> pgf_info->num_of_user_mappings = 0;
> goto finish;
> diff -u -p a/drivers/accel/habanalabs/common/state_dump.c b/drivers/accel/habanalabs/common/state_dump.c
> --- a/drivers/accel/habanalabs/common/state_dump.c
> +++ b/drivers/accel/habanalabs/common/state_dump.c
> @@ -272,7 +272,8 @@ static u32 *hl_state_dump_read_sync_obje
> base_addr = sds->props[SP_SYNC_OBJ_BASE_ADDR] +
> sds->props[SP_NEXT_SYNC_OBJ_ADDR] * index;
>
> - sync_objects = vmalloc(sds->props[SP_SYNC_OBJ_AMOUNT] * sizeof(u32));
> + sync_objects = vmalloc_array(sds->props[SP_SYNC_OBJ_AMOUNT],
> + sizeof(u32));
> if (!sync_objects)
> return NULL;
>
> @@ -453,8 +454,8 @@ hl_state_dump_alloc_read_sm_block_monito
> s64 base_addr; /* Base addr can be negative */
> int i;
>
> - monitors = vmalloc(sds->props[SP_MONITORS_AMOUNT] *
> - sizeof(struct hl_mon_state_dump));
> + monitors = vmalloc_array(sds->props[SP_MONITORS_AMOUNT],
> + sizeof(struct hl_mon_state_dump));
> if (!monitors)
> return NULL;
>
>
Reviewed-by: Oded Gabbay <[email protected]>