Skip to contentSkip to conversation

iommu/virtio: Add __counted_by for struct viommu_request and use struct_size()

PATCH Applied Gustavo A. R. Silva 4 participants 4 messages Oct 9, 2023 – Oct 16, 2023

Subsystems (3)
virtio core IOMMU virtio IOMMU driver
lore
Share & tools
lore

Gustavo A. R. Silva

author
#0 lore raw

PATCH 1/1 iommu/virtio: Add __counted_by for struct viommu_request and use struct_size()

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

While there, use struct_size() helper, instead of the open-coded version, to calculate the size for the allocation of the whole flexible structure, including of course, the flexible-array member.

This code was found with the help of Coccinelle, and audited and fixed manually.

Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 drivers/iommu/virtio-iommu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iommu/virtio-iommu.c +2 -2
index 17dcd826f5c2..379ebe03efb6 100644
@@ -85,7 +85,7 @@ struct viommu_request {
 	void				*writeback;
 	unsigned int			write_offset;
 	unsigned int			len;
-	char				buf[];
+	char				buf[] __counted_by(len);
 };
 
 #define VIOMMU_FAULT_RESV_MASK		0xffffff00

@@ -230,7 +230,7 @@ static int __viommu_add_req(struct viommu_dev *viommu, void *buf, size_t len,
 	if (write_offset <= 0)
 		return -EINVAL;
 
-	req = kzalloc(sizeof(*req) + len, GFP_ATOMIC);
+	req = kzalloc(struct_size(req, buf, len), GFP_ATOMIC);
 	if (!req)
 		return -ENOMEM;
Signature · 1 line
2.34.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 42 lines · Gustavo A. R. Silva

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

While there, use struct_size() helper, instead of the open-coded version, to calculate the size for the allocation of the whole flexible structure, including of course, the flexible-array member.

This code was found with the help of Coccinelle, and audited and fixed manually.

Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 drivers/iommu/virtio-iommu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iommu/virtio-iommu.c +2 -3
index 17dcd826f5c2..379ebe03efb6 100644
@@ -85,7 +85,7 @@ struct viommu_request {
        void                            *writeback;
        unsigned int                    write_offset;
        unsigned int                    len;
-       char                            buf[];
+       char                            buf[] __counted_by(len);
 };
 
 #define VIOMMU_FAULT_RESV_MASK         0xffffff00

@@ -230,7 +230,7 @@ static int __viommu_add_req(struct viommu_dev *viommu, void *buf, size_t len,
        if (write_offset <= 0)
                return -EINVAL;
 
-       req = kzalloc(sizeof(*req) + len, GFP_ATOMIC);
+       req = kzalloc(struct_size(req, buf, len), GFP_ATOMIC);
        if (!req)
                return -ENOMEM;
 
--
Quoted 3 lines

2.34.1

The __counted_by annotation and the usage of struct_size look right!

Reviewed-by Justin Stitt <[email protected]>
Reviewed-by on v1 1/1
#2 lore raw
In reply to Gustavo A. R. Silva
Quoted 6 lines · Gustavo A. R. Silva

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

Quoted 8 lines

While there, use struct_size() helper, instead of the open-coded version, to calculate the size for the allocation of the whole flexible structure, including of course, the flexible-array member.

This code was found with the help of Coccinelle, and audited and fixed manually.

Signed-off-by Gustavo A. R. Silva <[email protected]>
Reviewed-by Jean-Philippe Brucker <[email protected]>
Quoted 29 lines
---
 drivers/iommu/virtio-iommu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iommu/virtio-iommu.c +2 -2
index 17dcd826f5c2..379ebe03efb6 100644
@@ -85,7 +85,7 @@ struct viommu_request {
 	void				*writeback;
 	unsigned int			write_offset;
 	unsigned int			len;
-	char				buf[];
+	char				buf[] __counted_by(len);
 };
 
 #define VIOMMU_FAULT_RESV_MASK		0xffffff00

@@ -230,7 +230,7 @@ static int __viommu_add_req(struct viommu_dev *viommu, void *buf, size_t len,
 	if (write_offset <= 0)
 		return -EINVAL;
 
-	req = kzalloc(sizeof(*req) + len, GFP_ATOMIC);
+	req = kzalloc(struct_size(req, buf, len), GFP_ATOMIC);
 	if (!req)
 		return -ENOMEM;
Signature · 1 line
2.34.1