Re: [PATCH 4/4] ALSA: emu10k1: Cocci spatch "alloc_cast"

[Takashi Iwai]

On Thu, 21 Sep 2017 19:39:15 +0200,
Al Viro wrote:
> 
> On Thu, Sep 21, 2017 at 08:33:46AM +0200, Thomas Meyer wrote:
> > Remove casting the values returned by memory allocation functions like
> > kmalloc, kzalloc, kmem_cache_alloc, kmem_cache_zalloc etc."
> > Found by coccinelle spatch "api/alloc/alloc_cast.cocci"
> > 
> > Signed-off-by: Thomas Meyer <thomas@xxxxxxxx>
> > ---
> > 
> > diff -u -p a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
> > --- a/sound/pci/emu10k1/emufx.c
> > +++ b/sound/pci/emu10k1/emufx.c
> > @@ -1218,7 +1218,7 @@ static int _snd_emu10k1_audigy_init_efx(
> >  	if (!icode)
> >  		return err;
> >  
> > -	icode->gpr_map = (u_int32_t __user *) kcalloc(512 + 256 + 256 + 2 * 1024,
> > +	icode->gpr_map = kcalloc(512 + 256 + 256 + 2 * 1024,
> >  						      sizeof(u_int32_t), GFP_KERNEL);
> 
> 	And _this_ is a wonderful example of the reasons why that kind of
> patches is bloody bad.  The code you've caught is very obviously smelly -
> kcalloc() does *NOT* return a userland pointer.  You are whitewashing it;
> a major "something weird is going on here" sign is gone (something weird
> in that case is hopefully a set_fs(KERNEL_DS) somewhere nearby, and it
> is asking for careful review).

Right, the code touched by the patch is a really tricky one.  It uses
the same struct that contains __user pointer which is supposed to be
filled by ioctl, but in this case, the function allocates the kernel
buffer and passes it with a special flag mentioning it being a kernel
buffer later.


thanks,

Takashi