linux-kernel - [PATCH 2/5] libsrp: replace kfifo_init with kfifo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue,  8 Jan 2013 22:57:50 +0800
From:	Yuanhan Liu <yuanhan.liu@...ux.intel.com>
To:	linux-kernel@...r.kernel.org
Cc:	Yuanhan Liu <yuanhan.liu@...ux.intel.com>,
	"James E.J. Bottomley" <JBottomley@...allels.com>,
	Stefani Seibold <stefani@...bold.net>,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: [PATCH 2/5] libsrp: replace kfifo_init with kfifo_alloc

kfifo_init will use a pre-allocated buffer as fifo buffer; the buffer
size is determinted at caller side. While, kfifo will maintain a real
kfifo buffer size(rounddown power of 2 aligned). So, the two size may
not be equal.

So, if max is not power of 2, this code will not work. As it assume the
kfifo is able to hold max elments, but it is able to hold less than max
only.

To be safe, we should use kfifo_alloc instead, though it will not
address this issue. But a later patch to refactor kfifo_alloc to be a
log API will fix it.

Cc: James E.J. Bottomley <JBottomley@...allels.com>
Cc: Stefani Seibold <stefani@...bold.net>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Signed-off-by: Yuanhan Liu <yuanhan.liu@...ux.intel.com>
---
 drivers/scsi/libsrp.c |   22 ++++++++++------------
 include/scsi/libsrp.h |    1 -
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/drivers/scsi/libsrp.c b/drivers/scsi/libsrp.c
index 0707ecd..63db792 100644
--- a/drivers/scsi/libsrp.c
+++ b/drivers/scsi/libsrp.c
@@ -50,34 +50,32 @@ static int srp_iu_pool_alloc(struct srp_queue *q, size_t max,
 			     struct srp_buf **ring)
 {
 	int i;
+	int ret;
 	struct iu_entry *iue;
 
-	q->pool = kcalloc(max, sizeof(struct iu_entry *), GFP_KERNEL);
+	q->pool = kcalloc(max, sizeof(struct iu_entry), GFP_KERNEL);
 	if (!q->pool)
 		return -ENOMEM;
-	q->items = kcalloc(max, sizeof(struct iu_entry), GFP_KERNEL);
-	if (!q->items)
-		goto free_pool;
+
+	ret = kfifo_alloc(&q->queue, max * sizeof(void *), GFP_KERNEL);
+	if (ret < 0) {
+		kfree(q->pool);
+		return ret;
+	}
 
 	spin_lock_init(&q->lock);
-	kfifo_init(&q->queue, (void *) q->pool, max * sizeof(void *));
 
-	for (i = 0, iue = q->items; i < max; i++) {
+	for (i = 0, iue = q->pool; i < max; i++) {
 		kfifo_in(&q->queue, (void *) &iue, sizeof(void *));
 		iue->sbuf = ring[i];
 		iue++;
 	}
 	return 0;
-
-	kfree(q->items);
-free_pool:
-	kfree(q->pool);
-	return -ENOMEM;
 }
 
 static void srp_iu_pool_free(struct srp_queue *q)
 {
-	kfree(q->items);
+	kfifo_free(&q->queue);
 	kfree(q->pool);
 }
 
diff --git a/include/scsi/libsrp.h b/include/scsi/libsrp.h
index f4105c9..999b1e7 100644
--- a/include/scsi/libsrp.h
+++ b/include/scsi/libsrp.h
@@ -21,7 +21,6 @@ struct srp_buf {
 
 struct srp_queue {
 	void *pool;
-	void *items;
 	struct kfifo queue;
 	spinlock_t lock;
 };
-- 
1.7.7.6

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/