[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <eae36648-6f9f-486d-b352-c92a315431a1@intel.com>
Date: Fri, 23 Aug 2024 06:27:58 +0200
From: Przemek Kitszel <przemyslaw.kitszel@...el.com>
To: Kees Cook <kees@...nel.org>, Vlastimil Babka <vbabka@...e.cz>
CC: Christoph Lameter <cl@...ux.com>, Pekka Enberg <penberg@...nel.org>, David
Rientjes <rientjes@...gle.com>, Joonsoo Kim <iamjoonsoo.kim@....com>, Andrew
Morton <akpm@...ux-foundation.org>, Roman Gushchin
<roman.gushchin@...ux.dev>, Hyeonggon Yoo <42.hyeyoo@...il.com>, "Gustavo A .
R . Silva" <gustavoars@...nel.org>, Bill Wendling <morbo@...gle.com>, "Justin
Stitt" <justinstitt@...gle.com>, Jann Horn <jannh@...gle.com>, Marco Elver
<elver@...gle.com>, <linux-mm@...ck.org>, Nathan Chancellor
<nathan@...nel.org>, Nick Desaulniers <ndesaulniers@...gle.com>,
<linux-kernel@...r.kernel.org>, <llvm@...ts.linux.dev>,
<linux-hardening@...r.kernel.org>
Subject: Re: [PATCH v3] slab: Introduce kmalloc_obj() and family
On 8/23/24 01:13, Kees Cook wrote:
> (...) For cases where the total size of the allocation is needed,
> the kmalloc_obj_sz(), kmalloc_objs_sz(), and kmalloc_flex_sz() family
> of macros can be used. For example:
>
> info->size = struct_size(ptr, flex_member, count);
> ptr = kmalloc(info->size, gfp);
>
> becomes:
>
> kmalloc_flex_sz(ptr, flex_member, count, gfp, &info->size);
>
> Internal introspection of allocated type now becomes possible, allowing
> for future alignment-aware choices and hardening work. For example,
> adding __alignof(*ptr) as an argument to the internal allocators so that
> appropriate/efficient alignment choices can be made, or being able to
> correctly choose per-allocation offset randomization within a bucket
> that does not break alignment requirements.
>
> Introduces __flex_count() for when __builtin_get_counted_by() is added
> by GCC[1] and Clang[2]. The internal use of __flex_count() allows for
> automatically setting the counter member of a struct's flexible array
> member when it has been annotated with __counted_by(), avoiding any
> missed early size initializations while __counted_by() annotations are
> added to the kernel. Additionally, this also checks for "too large"
> allocations based on the type size of the counter variable. For example:
>
> if (count > type_max(ptr->flex_count))
> fail...;
> info->size = struct_size(ptr, flex_member, count);
> ptr = kmalloc(info->size, gfp);
> ptr->flex_count = count;
>
> becomes (i.e. unchanged from earlier example):
>
> kmalloc_flex_sz(ptr, flex_member, count, gfp, &info->size);
As there could be no __builtin_get_counted_by() available, caller still
needs to fill the counted-by variable, right? So it is possible to just
pass the in the struct pointer to fill? (last argument "&f->cnt" of the
snippet below):
struct foo {
int cnt;
struct bar[] __counted_by(cnt);
};
//...
struct foo *f;
kmalloc_flex_sz(f, cnt, 42, gfp, &f->cnt);
Powered by blists - more mailing lists