1. 18 Oct, 2023 6 commits
    • David Laight's avatar
      minmax: allow min()/max()/clamp() if the arguments have the same signedness. · d03eba99
      David Laight authored
      The type-check in min()/max() is there to stop unexpected results if a
      negative value gets converted to a large unsigned value.  However it also
      rejects 'unsigned int' v 'unsigned long' compares which are common and
      never problematc.
      
      Replace the 'same type' check with a 'same signedness' check.
      
      The new test isn't itself a compile time error, so use static_assert() to
      report the error and give a meaningful error message.
      
      Due to the way builtin_choose_expr() works detecting the error in the
      'non-constant' side (where static_assert() can be used) also detects
      errors when the arguments are constant.
      
      Link: https://lkml.kernel.org/r/fe7e6c542e094bfca655abcd323c1c98@AcuMS.aculab.comSigned-off-by: default avatarDavid Laight <david.laight@aculab.com>
      Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
      Cc: Christoph Hellwig <hch@infradead.org>
      Cc: Jason A. Donenfeld <Jason@zx2c4.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      d03eba99
    • David Laight's avatar
      minmax: add umin(a, b) and umax(a, b) · 80fcac55
      David Laight authored
      Patch series "minmax: Relax type checks in min() and max()", v4.
      
      The min() (etc) functions in minmax.h require that the arguments have
      exactly the same types.
      
      However when the type check fails, rather than look at the types and fix
      the type of a variable/constant, everyone seems to jump on min_t().  In
      reality min_t() ought to be rare - when something unusual is being done,
      not normality.
      
      The orginal min() (added in 2.4.9) replaced several inline functions and
      included the type - so matched the implicit casting of the function call. 
      This was renamed min_t() in 2.4.10 and the current min() added.  There is
      no actual indication that the conversion of negatve values to large
      unsigned values has ever been an actual problem.
      
      A quick grep shows 5734 min() and 4597 min_t().  Having the casts on
      almost half of the calls shows that something is clearly wrong.
      
      If the wrong type is picked (and it is far too easy to pick the type of
      the result instead of the larger input) then significant bits can get
      discarded.
      
      Pretty much the worst example is in the derived clamp_val(), consider:
              unsigned char x = 200u;
              y = clamp_val(x, 10u, 300u);
      
      I also suspect that many of the min_t(u16, ...) are actually wrong.  For
      example copy_data() in printk_ringbuffer.c contains:
      
              data_size = min_t(u16, buf_size, len);
      
      Here buf_size is 'unsigned int' and len 'u16', pass a 64k buffer (can you
      prove that doesn't happen?) and no data is returned.  Apparantly it did -
      and has since been fixed.
      
      The only reason that most of the min_t() are 'fine' is that pretty much
      all the values in the kernel are between 0 and INT_MAX.
      
      Patch 1 adds umin(), this uses integer promotions to convert both
      arguments to 'unsigned long long'.  It can be used to compare a signed
      type that is known to contain a non-negative value with an unsigned type. 
      The compiler typically optimises it all away.  Added first so that it can
      be referred to in patch 2.
      
      Patch 2 replaces the 'same type' check with a 'same signedness' one.  This
      makes min(unsigned_int_var, sizeof()) be ok.  The error message is also
      improved and will contain the expanded form of both arguments (useful for
      seeing how constants are defined).
      
      Patch 3 just fixes some whitespace.
      
      Patch 4 allows comparisons of 'unsigned char' and 'unsigned short' to
      signed types.  The integer promotion rules convert them both to 'signed
      int' prior to the comparison so they can never cause a negative value be
      converted to a large positive one.
      
      Patch 5 (rewritted for v4) allows comparisons of unsigned values against
      non-negative constant integer expressions.  This makes
      min(unsigned_int_var, 4) be ok.
      
      The only common case that is still errored is the comparison of signed
      values against unsigned constant integer expressions below __INT_MAX__. 
      Typcally min(int_val, sizeof (foo)), the real fix for this is casting the
      constant: min(int_var, (int)sizeof (foo)).
      
      With all the patches applied pretty much all the min_t() could be replaced
      by min(), and most of the rest by umin().  However they all need careful
      inspection due to code like:
      
              sz = min_t(unsigned char, sz - 1, LIM - 1) + 1;
      
      which converts 0 to LIM.
      
      
      This patch (of 6):
      
      umin() and umax() can be used when min()/max() errors a signed v unsigned
      compare when the signed value is known to be non-negative.
      
      Unlike min_t(some_unsigned_type, a, b) umin() will never mask off high
      bits if an inappropriate type is selected.
      
      The '+ 0u + 0ul + 0ull' may look strange.
      The '+ 0u' is needed for 'signed int' on 64bit systems.
      The '+ 0ul' is needed for 'signed long' on 32bit systems.
      The '+ 0ull' is needed for 'signed long long'.
      
      Link: https://lkml.kernel.org/r/b97faef60ad24922b530241c5d7c933c@AcuMS.aculab.com
      Link: https://lkml.kernel.org/r/41d93ca827a248698ec64bf57e0c05a5@AcuMS.aculab.comSigned-off-by: default avatarDavid Laight <david.laight@aculab.com>
      Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
      Cc: Christoph Hellwig <hch@infradead.org>
      Cc: Jason A. Donenfeld <Jason@zx2c4.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      80fcac55
    • Li kunyu's avatar
      kernel/signal: remove unnecessary NULL values from ucounts · a287116a
      Li kunyu authored
      ucounts is assigned first, so it does not need to initialize the
      assignment.
      
      Link: https://lkml.kernel.org/r/20230926022410.4280-1-kunyu@nfschina.comSigned-off-by: default avatarLi kunyu <kunyu@nfschina.com>
      Acked-by: default avatarOleg Nesterov <oleg@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      a287116a
    • Kees Cook's avatar
      ocfs2: annotate struct ocfs2_replay_map with __counted_by · a1cfa251
      Kees Cook authored
      Prepare for the coming implementation by GCC and Clang of the __counted_by
      attribute.  Flexible array members annotated with __counted_by can have
      their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS
      (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
      functions).
      
      As found with Coccinelle[1], add __counted_by for struct ocfs2_replay_map.
      
      [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
      
      Link: https://lkml.kernel.org/r/20230922174925.work.293-kees@kernel.orgSigned-off-by: default avatarKees Cook <keescook@chromium.org>
      Reviewed-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
      Reviewed-by: default avatarJoseph Qi <joseph.qi@linux.alibaba.com>
      Cc: Mark Fasheh <mark@fasheh.com>
      Cc: Joel Becker <jlbec@evilplan.org>
      Cc: Nathan Chancellor <nathan@kernel.org>
      Cc: Nick Desaulniers <ndesaulniers@google.com>
      Cc: Tom Rix <trix@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      a1cfa251
    • Christophe JAILLET's avatar
      kstrtox: remove strtobool() · 9bf2850c
      Christophe JAILLET authored
      The conversion from strtobool() to kstrtobool() is completed.  So
      strtobool() can now be removed.
      
      Link: https://lkml.kernel.org/r/87e3cc2547df174cd5af1fadbf866be4ef9e8e45.1694878151.git.christophe.jaillet@wanadoo.frSigned-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Reviewed-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      9bf2850c
    • Alexey Dobriyan's avatar
      extract and use FILE_LINE macro · 5097a69d
      Alexey Dobriyan authored
      Extract nifty FILE_LINE useful for printk style debugging:
      
      	printk("%s\n", FILE_LINE);
      
      It should not be used en mass probably because __FILE__ string literals
      can be merged while FILE_LINE's won't. But for debugging it is what
      the doctor ordered.
      
      Don't add leading and trailing underscores, they're painful to type. 
      Trust me, I've tried both versions.
      
      Link: https://lkml.kernel.org/r/ebf12ac4-5a61-4b12-b8b0-1253eb371332@p183Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Takashi Iwai <tiwai@suse.de>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      5097a69d
  2. 04 Oct, 2023 31 commits
  3. 01 Oct, 2023 3 commits
    • Linus Torvalds's avatar
      Linux 6.6-rc4 · 8a749fd1
      Linus Torvalds authored
      8a749fd1
    • Linus Torvalds's avatar
      Merge tag 'kbuild-fixes-v6.6-2' of... · e81a2dab
      Linus Torvalds authored
      Merge tag 'kbuild-fixes-v6.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
      
      Pull Kbuild fixes from Masahiro Yamada:
      
       - Fix the module compression with xz so the in-kernel decompressor
         works
      
       - Document a kconfig idiom to express an optional dependency between
         modules
      
       - Make modpost, when W=1 is given, detect broken drivers that reference
         .exit.* sections
      
       - Remove unused code
      
      * tag 'kbuild-fixes-v6.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        kbuild: remove stale code for 'source' symlink in packaging scripts
        modpost: Don't let "driver"s reference .exit.*
        vmlinux.lds.h: remove unused CPU_KEEP and CPU_DISCARD macros
        modpost: add missing else to the "of" check
        Documentation: kbuild: explain handling optional dependencies
        kbuild: Use CRC32 and a 1MiB dictionary for XZ compressed modules
      e81a2dab
    • Linus Torvalds's avatar
      Merge tag 'mm-hotfixes-stable-2023-10-01-08-34' of... · d2c52315
      Linus Torvalds authored
      Merge tag 'mm-hotfixes-stable-2023-10-01-08-34' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
      
      Pull misc fixes from Andrew Morton:
       "Fourteen hotfixes, eleven of which are cc:stable. The remainder
        pertain to issues which were introduced after 6.5"
      
      * tag 'mm-hotfixes-stable-2023-10-01-08-34' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
        Crash: add lock to serialize crash hotplug handling
        selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error
        mm: mempolicy: keep VMA walk if both MPOL_MF_STRICT and MPOL_MF_MOVE are specified
        mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
        mm, memcg: reconsider kmem.limit_in_bytes deprecation
        mm: zswap: fix potential memory corruption on duplicate store
        arm64: hugetlb: fix set_huge_pte_at() to work with all swap entries
        mm: hugetlb: add huge page size param to set_huge_pte_at()
        maple_tree: add MAS_UNDERFLOW and MAS_OVERFLOW states
        maple_tree: add mas_is_active() to detect in-tree walks
        nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
        mm: abstract moving to the next PFN
        mm: report success more often from filemap_map_folio_range()
        fs: binfmt_elf_efpic: fix personality for ELF-FDPIC
      d2c52315