Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.34 as permitted sender) client-ip=23.128.96.34;
MIME-Version: 1.0
References: <your-ad-here.call-01697881440-ext-2458@work.hours> <CAHk-=wgTUz1bdY6zvsN4ED0arCLE8Sb==1GH8d0sjm5bu7zesQ@mail.gmail.com>
In-Reply-To: <CAHk-=wgTUz1bdY6zvsN4ED0arCLE8Sb==1GH8d0sjm5bu7zesQ@mail.gmail.com>
From:   Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sat, 21 Oct 2023 11:08:31 -0700
Message-ID: <CAHk-=wjxAk=PQBX4OvscNfGKfc+M8iKmNd6D39wOZzXV0k729w@mail.gmail.com>
Subject: Re: [GIT PULL] s390 fixes for 6.6-rc7
To:     Vasily Gorbik <gor@linux.ibm.com>,
        Andy Shevchenko <andriy.shevchenko@intel.com>,
        Dmitry Torokhov <dmitry.torokhov@gmail.com>,
        Kees Cook <keescook@chromium.org>
Cc:     Heiko Carstens <hca@linux.ibm.com>,
        Alexander Gordeev <agordeev@linux.ibm.com>,
        linux-kernel@vger.kernel.org, linux-s390@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Just re-quoting my suggestion here and adding Andy and Dmitry, who did
the original bitmap_alloc() helper interfaces a few years ago.

Also adding Kees in case he has any hardening suggestions, since this
is about (incorrect) overflow handling.

Kees: see my rant about mindlessly doing overflow handling in the wrong place in

   https://lore.kernel.org/all/CAHk-=wgTUz1bdY6zvsN4ED0arCLE8Sb==1GH8d0sjm5bu7zesQ@mail.gmail.com/

in case you or somebody has a better idea for BITS_TO_LONG handling
than just "you need to check for zero before and after".

             Linus

On Sat, 21 Oct 2023 at 10:56, Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> If you *do* want to add proper overflow handling, you'd need to either
> fix BITS_TO_LONGS() some way (which is actually non-trivial since it
> needs to be able to stay a constant and only use the argument once),
> or you do something like
>
>         if (!bits)
>                 return ZERO_SIZE_PTR;
>         longs = BITS_TO_LONG(bits);
>         if (!longs)
>                 return NULL;
>         return vzalloc(longs * sizeof(long));
>
> and I'd suggest maybe we should
>
>  (a) do the above checking in our bitmap_alloc() routines
>
>  (b) also change our bitmap_alloc() routines to take 'size_t' instead
> of 'unsigned int' bit counts
>
>  (c) and finally, add that vzalloc() case, but simply using
>
>         kvmalloc_array(n, size, flags | __GFP_ZERO);
>
> instead.