diff options
| author | David Rientjes <rientjes@google.com> | 2009-08-26 14:29:22 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-08-26 20:06:52 -0700 |
| commit | b62e408c05228f40e69bb38a48db8961cac6cd23 (patch) | |
| tree | 40711bad4a60adb8f331d71574ec61e13c5a352d /include/linux | |
| parent | 8e7ee27095aee87b5db1b0061e2ceea5878a1bbd (diff) | |
| download | linux-3.10-b62e408c05228f40e69bb38a48db8961cac6cd23.tar.gz linux-3.10-b62e408c05228f40e69bb38a48db8961cac6cd23.tar.bz2 linux-3.10-b62e408c05228f40e69bb38a48db8961cac6cd23.zip | |
flex_array: convert element_nr formals to unsigned
It's problematic to allow signed element_nr's or total's to be passed as
part of the flex array API.
flex_array_alloc() allows total_nr_elements to be set to a negative
quantity, which is obviously erroneous.
flex_array_get() and flex_array_put() allows negative array indices in
dereferencing an array part, which could address memory mapped before
struct flex_array.
The fix is to convert all existing element_nr formals to be qualified as
unsigned. Existing checks to compare it to total_nr_elements or the max
array size based on element_size need not be changed.
Signed-off-by: David Rientjes <rientjes@google.com>
Cc: Dave Hansen <dave@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/flex_array.h | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/include/linux/flex_array.h b/include/linux/flex_array.h index 603160db7c9..45ff1849151 100644 --- a/include/linux/flex_array.h +++ b/include/linux/flex_array.h @@ -36,12 +36,14 @@ struct flex_array { .total_nr_elements = (total), \ } } } -struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags); -int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags); +struct flex_array *flex_array_alloc(int element_size, unsigned int total, + gfp_t flags); +int flex_array_prealloc(struct flex_array *fa, unsigned int start, + unsigned int end, gfp_t flags); void flex_array_free(struct flex_array *fa); void flex_array_free_parts(struct flex_array *fa); -int flex_array_put(struct flex_array *fa, int element_nr, void *src, +int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src, gfp_t flags); -void *flex_array_get(struct flex_array *fa, int element_nr); +void *flex_array_get(struct flex_array *fa, unsigned int element_nr); #endif /* _FLEX_ARRAY_H */ |