Merge tag 'drm-next-2023-10-31-1' of git://anongit.freedesktop.org/drm/drm

[linux-2.6-microblaze.git] / include / linux / string.h

diff --git a/include/linux/string.h b/include/linux/string.h
index dbfc664..5077776 100644 (file)
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -5,7 +5,9 @@
 #include <linux/compiler.h>    /* for inline */
 #include <linux/types.h>       /* for size_t */
 #include <linux/stddef.h>      /* for NULL */
+#include <linux/err.h>         /* for ERR_PTR() */
 #include <linux/errno.h>       /* for E2BIG */
+#include <linux/overflow.h>    /* for check_mul_overflow() */
 #include <linux/stdarg.h>
 #include <uapi/linux/string.h>
 
@@ -14,6 +16,44 @@ extern void *memdup_user(const void __user *, size_t);
 extern void *vmemdup_user(const void __user *, size_t);
 extern void *memdup_user_nul(const void __user *, size_t);
 
+/**
+ * memdup_array_user - duplicate array from user space
+ * @src: source address in user space
+ * @n: number of array members to copy
+ * @size: size of one array member
+ *
+ * Return: an ERR_PTR() on failure. Result is physically
+ * contiguous, to be freed by kfree().
+ */
+static inline void *memdup_array_user(const void __user *src, size_t n, size_t size)
+{
+       size_t nbytes;
+
+       if (check_mul_overflow(n, size, &nbytes))
+               return ERR_PTR(-EOVERFLOW);
+
+       return memdup_user(src, nbytes);
+}
+
+/**
+ * vmemdup_array_user - duplicate array from user space
+ * @src: source address in user space
+ * @n: number of array members to copy
+ * @size: size of one array member
+ *
+ * Return: an ERR_PTR() on failure. Result may be not
+ * physically contiguous. Use kvfree() to free.
+ */
+static inline void *vmemdup_array_user(const void __user *src, size_t n, size_t size)
+{
+       size_t nbytes;
+
+       if (check_mul_overflow(n, size, &nbytes))
+               return ERR_PTR(-EOVERFLOW);
+
+       return vmemdup_user(src, nbytes);
+}
+
 /*
  * Include machine specific inline routines
  */
@@ -277,10 +317,12 @@ void memcpy_and_pad(void *dest, size_t dest_len, const void *src, size_t count,
  */
 #define strtomem_pad(dest, src, pad)   do {                            \
        const size_t _dest_len = __builtin_object_size(dest, 1);        \
+       const size_t _src_len = __builtin_object_size(src, 1);          \
                                                                        \
        BUILD_BUG_ON(!__builtin_constant_p(_dest_len) ||                \
                     _dest_len == (size_t)-1);                          \
-       memcpy_and_pad(dest, _dest_len, src, strnlen(src, _dest_len), pad); \
+       memcpy_and_pad(dest, _dest_len, src,                            \
+                      strnlen(src, min(_src_len, _dest_len)), pad);    \
 } while (0)
 
 /**
@@ -298,10 +340,11 @@ void memcpy_and_pad(void *dest, size_t dest_len, const void *src, size_t count,
  */
 #define strtomem(dest, src)    do {                                    \
        const size_t _dest_len = __builtin_object_size(dest, 1);        \
+       const size_t _src_len = __builtin_object_size(src, 1);          \
                                                                        \
        BUILD_BUG_ON(!__builtin_constant_p(_dest_len) ||                \
                     _dest_len == (size_t)-1);                          \
-       memcpy(dest, src, min(_dest_len, strnlen(src, _dest_len)));     \
+       memcpy(dest, src, strnlen(src, min(_src_len, _dest_len)));      \
 } while (0)
 
 /**