The patch titled
Subject: relay: fix type mismatch when allocating memory in relay_create_buf()
has been added to the -mm mm-nonmm-unstable branch. Its filename is
relay-fix-type-mismatch-when-allocating-memory-in-relay_create_buf.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/relay-fix-type-mismatch-when-allocating-memory-in-relay_create_buf.patch
This patch will later appear in the mm-nonmm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Gavrilov Ilia <Ilia.Gavrilov@xxxxxxxxxxx>
Subject: relay: fix type mismatch when allocating memory in relay_create_buf()
Date: Tue, 29 Nov 2022 09:23:38 +0000
The 'padding' field of the 'rchan_buf' structure is an array of 'size_t'
elements, but the memory is allocated for an array of 'size_t *' elements.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Link: https://lkml.kernel.org/r/20221129092002.3538384-1-Ilia.Gavrilov@xxxxxxxxxxx
Fixes: b86ff981a825 ("[PATCH] relay: migrate from relayfs to a generic relay API")
Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov@xxxxxxxxxxx>
Cc: Colin Ian King <colin.i.king@xxxxxxxxx>
Cc: Jens Axboe <axboe@xxxxxxxxx>
Cc: wuchi <wuchi.zero@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
kernel/relay.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/kernel/relay.c~relay-fix-type-mismatch-when-allocating-memory-in-relay_create_buf
+++ a/kernel/relay.c
@@ -148,13 +148,13 @@ static struct rchan_buf *relay_create_bu
{
struct rchan_buf *buf;
- if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t *))
+ if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t))
return NULL;
buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
if (!buf)
return NULL;
- buf->padding = kmalloc_array(chan->n_subbufs, sizeof(size_t *),
+ buf->padding = kmalloc_array(chan->n_subbufs, sizeof(size_t),
GFP_KERNEL);
if (!buf->padding)
goto free_buf;
_
Patches currently in -mm which might be from Ilia.Gavrilov@xxxxxxxxxxx are
relay-fix-type-mismatch-when-allocating-memory-in-relay_create_buf.patch
