• David Rientjes's avatar
    flex_array: convert element_nr formals to unsigned · b62e408c
    David Rientjes authored
    It's problematic to allow signed element_nr's or total's to be passed as
    part of the flex array API.
    
    flex_array_alloc() allows total_nr_elements to be set to a negative
    quantity, which is obviously erroneous.
    
    flex_array_get() and flex_array_put() allows negative array indices in
    dereferencing an array part, which could address memory mapped before
    struct flex_array.
    
    The fix is to convert all existing element_nr formals to be qualified as
    unsigned.  Existing checks to compare it to total_nr_elements or the max
    array size based on element_size need not be changed.
    Signed-off-by: default avatarDavid Rientjes <rientjes@google.com>
    Cc: Dave Hansen <dave@linux.vnet.ibm.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    b62e408c
flex_array.h 1.2 KB