[PATCH 1/3] flex_array: flex_array_prealloc takes a number of elements, not an end

[PATCH 1/3] flex_array: flex_array_prealloc takes a number of elements, not an end

[Eric Paris]

Change flex_array_prealloc to take the number of elements for which space
should be allocated instead of the last (inclusive) element. Users
and documentation are updated accordingly.

Based-on-patch-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
---

 Documentation/flexible-arrays.txt |    4 ++--
 include/linux/flex_array.h        |    2 +-
 lib/flex_array.c                  |   13 ++++++++-----
 security/selinux/ss/policydb.c    |    6 +++---
 4 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/Documentation/flexible-arrays.txt b/Documentation/flexible-arrays.txt
index cb8a3a0..df904ae 100644
--- a/Documentation/flexible-arrays.txt
+++ b/Documentation/flexible-arrays.txt
@@ -66,10 +66,10 @@ trick is to ensure that any needed memory allocations are done before
 entering atomic context, using:
 
     int flex_array_prealloc(struct flex_array *array, unsigned int start,
-			    unsigned int end, gfp_t flags);
+			    unsigned int nr_elements, gfp_t flags);
 
 This function will ensure that memory for the elements indexed in the range
-defined by start and end has been allocated.  Thereafter, a
+defined by start and nr_elements has been allocated.  Thereafter, a
 flex_array_put() call on an element in that range is guaranteed not to
 block.
 
diff --git a/include/linux/flex_array.h b/include/linux/flex_array.h
index 70e4efa..ebeb2f3 100644
--- a/include/linux/flex_array.h
+++ b/include/linux/flex_array.h
@@ -61,7 +61,7 @@ struct flex_array {
 struct flex_array *flex_array_alloc(int element_size, unsigned int total,
 		gfp_t flags);
 int flex_array_prealloc(struct flex_array *fa, unsigned int start,
-		unsigned int end, gfp_t flags);
+		unsigned int nr_elements, gfp_t flags);
 void flex_array_free(struct flex_array *fa);
 void flex_array_free_parts(struct flex_array *fa);
 int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,
diff --git a/lib/flex_array.c b/lib/flex_array.c
index c0ea40b..0c33b24 100644
--- a/lib/flex_array.c
+++ b/lib/flex_array.c
@@ -232,10 +232,10 @@ EXPORT_SYMBOL(flex_array_clear);
 
 /**
  * flex_array_prealloc - guarantee that array space exists
- * @fa:		the flex array for which to preallocate parts
- * @start:	index of first array element for which space is allocated
- * @end:	index of last (inclusive) element for which space is allocated
- * @flags:	page allocation flags
+ * @fa:			the flex array for which to preallocate parts
+ * @start:		index of first array element for which space is allocated
+ * @nr_elements:	number of elements for which space is allocated
+ * @flags:		page allocation flags
  *
  * This will guarantee that no future calls to flex_array_put()
  * will allocate memory.  It can be used if you are expecting to
@@ -245,13 +245,16 @@ EXPORT_SYMBOL(flex_array_clear);
  * Locking must be provided by the caller.
  */
 int flex_array_prealloc(struct flex_array *fa, unsigned int start,
-			unsigned int end, gfp_t flags)
+			unsigned int nr_elements, gfp_t flags)
 {
 	int start_part;
 	int end_part;
 	int part_nr;
+	unsigned int end;
 	struct flex_array_part *part;
 
+	end = start + nr_elements - 1;
+
 	if (start >= fa->total_nr_elements || end >= fa->total_nr_elements)
 		return -ENOSPC;
 	if (elements_fit_in_base(fa))
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 3258799..1b150d7 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -551,7 +551,7 @@ static int policydb_index(struct policydb *p)
 		goto out;
 
 	rc = flex_array_prealloc(p->type_val_to_struct_array, 0,
-				 p->p_types.nprim - 1, GFP_KERNEL | __GFP_ZERO);
+				 p->p_types.nprim, GFP_KERNEL | __GFP_ZERO);
 	if (rc)
 		goto out;
 
@@ -568,7 +568,7 @@ static int policydb_index(struct policydb *p)
 			goto out;
 
 		rc = flex_array_prealloc(p->sym_val_to_name[i],
-					 0, p->symtab[i].nprim - 1,
+					 0, p->symtab[i].nprim,
 					 GFP_KERNEL | __GFP_ZERO);
 		if (rc)
 			goto out;
@@ -2445,7 +2445,7 @@ int policydb_read(struct policydb *p, void *fp)
 		goto bad;
 
 	/* preallocate so we don't have to worry about the put ever failing */
-	rc = flex_array_prealloc(p->type_attr_map_array, 0, p->p_types.nprim - 1,
+	rc = flex_array_prealloc(p->type_attr_map_array, 0, p->p_types.nprim,
 				 GFP_KERNEL | __GFP_ZERO);
 	if (rc)
 		goto bad;

[PATCH 2/3] flex_arrays: allow zero length flex arrays

[Eric Paris]

Just like kmalloc will allow one to allocate a 0 length segment of memory
flex arrays should do the same thing.  It should bomb if you try to use
something, but it should at least allow the allocation.

Based-on-patch-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
---

 lib/flex_array.c |   11 ++++++++++-
 1 files changed, 10 insertions(+), 1 deletions(-)

diff --git a/lib/flex_array.c b/lib/flex_array.c
index 0c33b24..2554a5f 100644
--- a/lib/flex_array.c
+++ b/lib/flex_array.c
@@ -253,9 +253,16 @@ int flex_array_prealloc(struct flex_array *fa, unsigned int start,
 	unsigned int end;
 	struct flex_array_part *part;
 
+	if (!fa->total_nr_elements && !start)
+		return 0;
+	if (start >= fa->total_nr_elements)
+		return -ENOSPC;
+	if (!nr_elements)
+		return 0;
+
 	end = start + nr_elements - 1;
 
-	if (start >= fa->total_nr_elements || end >= fa->total_nr_elements)
+	if (end >= fa->total_nr_elements)
 		return -ENOSPC;
 	if (elements_fit_in_base(fa))
 		return 0;
@@ -346,6 +353,8 @@ int flex_array_shrink(struct flex_array *fa)
 	int part_nr;
 	int ret = 0;
 
+	if (!fa->total_nr_elements)
+		return 0;
 	if (elements_fit_in_base(fa))
 		return ret;
 	for (part_nr = 0; part_nr < FLEX_ARRAY_NR_BASE_PTRS; part_nr++) {

[PATCH 3/3] flex_array: allow 0 length elements

[Eric Paris]

allow elements of 0 length.  We already allow flex_arrays with 0 elements, but
this patch allow us to have elements that are 0 bytes long.

Based-on-patch-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
---

 lib/flex_array.c |   26 ++++++++++++++++++++------
 1 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/lib/flex_array.c b/lib/flex_array.c
index 2554a5f..dcd91d5 100644
--- a/lib/flex_array.c
+++ b/lib/flex_array.c
@@ -88,8 +88,11 @@ struct flex_array *flex_array_alloc(int element_size, unsigned int total,
 					gfp_t flags)
 {
 	struct flex_array *ret;
-	int max_size = FLEX_ARRAY_NR_BASE_PTRS *
-				FLEX_ARRAY_ELEMENTS_PER_PART(element_size);
+	int max_size = 0;
+
+	if (element_size)
+		max_size = FLEX_ARRAY_NR_BASE_PTRS *
+			   FLEX_ARRAY_ELEMENTS_PER_PART(element_size);
 
 	/* max_size will end up 0 if element_size > PAGE_SIZE */
 	if (total > max_size)
@@ -183,15 +186,18 @@ __fa_get_part(struct flex_array *fa, int part_nr, gfp_t flags)
 int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,
 			gfp_t flags)
 {
-	int part_nr = fa_element_to_part_nr(fa, element_nr);
+	int part_nr;
 	struct flex_array_part *part;
 	void *dst;
 
 	if (element_nr >= fa->total_nr_elements)
 		return -ENOSPC;
+	if (!fa->element_size)
+		return 0;
 	if (elements_fit_in_base(fa))
 		part = (struct flex_array_part *)&fa->parts[0];
 	else {
+		part_nr = fa_element_to_part_nr(fa, element_nr);
 		part = __fa_get_part(fa, part_nr, flags);
 		if (!part)
 			return -ENOMEM;
@@ -211,15 +217,18 @@ EXPORT_SYMBOL(flex_array_put);
  */
 int flex_array_clear(struct flex_array *fa, unsigned int element_nr)
 {
-	int part_nr = fa_element_to_part_nr(fa, element_nr);
+	int part_nr;
 	struct flex_array_part *part;
 	void *dst;
 
 	if (element_nr >= fa->total_nr_elements)
 		return -ENOSPC;
+	if (!fa->element_size)
+		return 0;
 	if (elements_fit_in_base(fa))
 		part = (struct flex_array_part *)&fa->parts[0];
 	else {
+		part_nr = fa_element_to_part_nr(fa, element_nr);
 		part = fa->parts[part_nr];
 		if (!part)
 			return -EINVAL;
@@ -264,6 +273,8 @@ int flex_array_prealloc(struct flex_array *fa, unsigned int start,
 
 	if (end >= fa->total_nr_elements)
 		return -ENOSPC;
+	if (!fa->element_size)
+		return 0;
 	if (elements_fit_in_base(fa))
 		return 0;
 	start_part = fa_element_to_part_nr(fa, start);
@@ -291,14 +302,17 @@ EXPORT_SYMBOL(flex_array_prealloc);
  */
 void *flex_array_get(struct flex_array *fa, unsigned int element_nr)
 {
-	int part_nr = fa_element_to_part_nr(fa, element_nr);
+	int part_nr;
 	struct flex_array_part *part;
 
+	if (!fa->element_size)
+		return NULL;
 	if (element_nr >= fa->total_nr_elements)
 		return NULL;
 	if (elements_fit_in_base(fa))
 		part = (struct flex_array_part *)&fa->parts[0];
 	else {
+		part_nr = fa_element_to_part_nr(fa, element_nr);
 		part = fa->parts[part_nr];
 		if (!part)
 			return NULL;
@@ -353,7 +367,7 @@ int flex_array_shrink(struct flex_array *fa)
 	int part_nr;
 	int ret = 0;
 
-	if (!fa->total_nr_elements)
+	if (!fa->total_nr_elements || !fa->element_size)
 		return 0;
 	if (elements_fit_in_base(fa))
 		return ret;

Re: [PATCH 1/3] flex_array: flex_array_prealloc takes a number of elements, not an end

[Andrew Morton]

On Mon, 25 Apr 2011 21:45:31 -0400
Eric Paris <eparis@redhat.com> wrote:

> Change flex_array_prealloc to take the number of elements for which space
> should be allocated instead of the last (inclusive) element. Users
> and documentation are updated accordingly.

Why?

Re: [PATCH 2/3] flex_arrays: allow zero length flex arrays

[Andrew Morton]

On Mon, 25 Apr 2011 21:45:37 -0400
Eric Paris <eparis@redhat.com> wrote:

> Just like kmalloc will allow one to allocate a 0 length segment of memory
> flex arrays should do the same thing.  It should bomb if you try to use
> something, but it should at least allow the allocation.

Well I suppose that's vaguely sensible, but it adds additional code for
no apparent benefit.

IOW: why?

Re: [PATCH 3/3] flex_array: allow 0 length elements

[Andrew Morton]

On Mon, 25 Apr 2011 21:45:43 -0400
Eric Paris <eparis@redhat.com> wrote:

> allow elements of 0 length.  We already allow flex_arrays with 0 elements, but
> this patch allow us to have elements that are 0 bytes long.

Again, sounds vaguely useful but it adds code and churns the code for
no apparent benefit.

IOW2: why?

Re: [PATCH 1/3] flex_array: flex_array_prealloc takes a number of elements, not an end

[Eric Paris]

On Tue, 2011-04-26 at 11:56 -0700, Andrew Morton wrote:
> On Mon, 25 Apr 2011 21:45:31 -0400
> Eric Paris <eparis@redhat.com> wrote:
> 
> > Change flex_array_prealloc to take the number of elements for which space
> > should be allocated instead of the last (inclusive) element. Users
> > and documentation are updated accordingly.
> 
> Why?

All three of these patches came from these discussions:
http://marc.info/?t=129552800100005&r=1&w=2
http://marc.info/?t=129646395700004&r=1&w=2
http://marc.info/?t=129708178200007&r=1&w=2

1/3 was changed just because it seemed to be the way the interface was
used

2/3 was changed because the 2.6.38 kernel fails to load certain selinux
policies which worked under 2.6.37 because of this lack of functionality

3/3 was changed just because that's how maybe it should work, although
there are no known users.

I can certainly update 2/3 to better explain the rational but I can't
really do any better on 1/3 and 3/3 other than to just say what the
change is......

-Eric

Re: [PATCH 1/3] flex_array: flex_array_prealloc takes a number of elements, not an end

[Dave Hansen]

On Mon, 2011-04-25 at 21:45 -0400, Eric Paris wrote:
> Change flex_array_prealloc to take the number of elements for which space
> should be allocated instead of the last (inclusive) element. Users
> and documentation are updated accordingly.
> 
> Based-on-patch-by: Steffen Klassert <steffen.klassert@secunet.com>
> Signed-off-by: Eric Paris <eparis@redhat.com>

Perhaps add this to the description?

flex_arrays got introduced before they had users.  When folks started
using it, they ended up needing a different API than we coded up
originally.  This swaps over to the API that folks apparently need.

Acked-by: Dave Hansen <dave@linux.vnet.ibm.com>

-- Dave

Re: [PATCH 2/3] flex_arrays: allow zero length flex arrays

[Dave Hansen]

On Mon, 2011-04-25 at 21:45 -0400, Eric Paris wrote:
> Just like kmalloc will allow one to allocate a 0 length segment of memory
> flex arrays should do the same thing.  It should bomb if you try to use
> something, but it should at least allow the allocation.
> 
> Based-on-patch-by: Steffen Klassert <steffen.klassert@secunet.com>
> Signed-off-by: Eric Paris <eparis@redhat.com>
> ---
> 
>  lib/flex_array.c |   11 ++++++++++-
>  1 files changed, 10 insertions(+), 1 deletions(-)
> 
> diff --git a/lib/flex_array.c b/lib/flex_array.c
> index 0c33b24..2554a5f 100644
> --- a/lib/flex_array.c
> +++ b/lib/flex_array.c
> @@ -253,9 +253,16 @@ int flex_array_prealloc(struct flex_array *fa, unsigned int start,
>  	unsigned int end;
>  	struct flex_array_part *part;
> 
> +	if (!fa->total_nr_elements && !start)
> +		return 0;

I guess it works either way, but I'd say that checking for a zero 'len'
prealloc would be more important (and meaningful) than checking a zero
'start'.

If someone passed start=0 and len=44 for a fa->total_nr_elements=0
array, I'd expect -ENOSPC, but this would return 0.

-- Dave

Re: [PATCH 2/3] flex_arrays: allow zero length flex arrays

[Eric Paris]

On Tue, 2011-04-26 at 13:38 -0700, Dave Hansen wrote:
> On Mon, 2011-04-25 at 21:45 -0400, Eric Paris wrote:
> > Just like kmalloc will allow one to allocate a 0 length segment of memory
> > flex arrays should do the same thing.  It should bomb if you try to use
> > something, but it should at least allow the allocation.
> > 
> > Based-on-patch-by: Steffen Klassert <steffen.klassert@secunet.com>
> > Signed-off-by: Eric Paris <eparis@redhat.com>
> > ---
> > 
> >  lib/flex_array.c |   11 ++++++++++-
> >  1 files changed, 10 insertions(+), 1 deletions(-)
> > 
> > diff --git a/lib/flex_array.c b/lib/flex_array.c
> > index 0c33b24..2554a5f 100644
> > --- a/lib/flex_array.c
> > +++ b/lib/flex_array.c
> > @@ -253,9 +253,16 @@ int flex_array_prealloc(struct flex_array *fa, unsigned int start,
> >  	unsigned int end;
> >  	struct flex_array_part *part;
> > 
> > +	if (!fa->total_nr_elements && !start)
> > +		return 0;
> 
> I guess it works either way, but I'd say that checking for a zero 'len'
> prealloc would be more important (and meaningful) than checking a zero
> 'start'.
> 
> If someone passed start=0 and len=44 for a fa->total_nr_elements=0
> array, I'd expect -ENOSPC, but this would return 0.

will fix.

if (!nr_elements && !start)
	return 0;

-Eric

> 
> -- Dave
> 

Re: [PATCH 3/3] flex_array: allow 0 length elements

[Dave Hansen]

On Mon, 2011-04-25 at 21:45 -0400, Eric Paris wrote:
> allow elements of 0 length.  We already allow flex_arrays with 0
> elements, but
> this patch allow us to have elements that are 0 bytes long.
> 
> Based-on-patch-by: Steffen Klassert <steffen.klassert@secunet.com>
> Signed-off-by: Eric Paris <eparis@redhat.com> 

I'd like to see a bit of the history in the changelog.  kmalloc(0)
returns NULL, and we'd effectively like to do the same since flex_arrays
really are like a mini allocator.  The 0-sized elements come from
userspace and we *have* to handle them in the security code, etc...

The code looks good, though.

Acked-by: Dave Hansen <dave@linux.vnet.ibm.com>

-- Dave