| Message ID | ee8110ed-6619-4bd7-9024-28c1f2ac24f4@moroto.mountain (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 81d23d2a24012e448f651e007fac2cfd20a45ce0 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v2,net] ptp: fix integer overflow in max_vclocks_store | expand |
On 17.06.2024 11:34, Dan Carpenter wrote: > On 32bit systems, the "4 * max" multiply can overflow. Use kcalloc() > to do the allocation to prevent this. > > Fixes: 44c494c8e30e ("ptp: track available ptp vclocks information") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- Thx, Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com> > v2: It's better to use kcalloc() instead of size_mul(). > > drivers/ptp/ptp_sysfs.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c > index a15460aaa03b..6b1b8f57cd95 100644 > --- a/drivers/ptp/ptp_sysfs.c > +++ b/drivers/ptp/ptp_sysfs.c > @@ -296,8 +296,7 @@ static ssize_t max_vclocks_store(struct device *dev, > if (max < ptp->n_vclocks) > goto out; > > - size = sizeof(int) * max; > - vclock_index = kzalloc(size, GFP_KERNEL); > + vclock_index = kcalloc(max, sizeof(int), GFP_KERNEL); > if (!vclock_index) { > err = -ENOMEM; > goto out;
Mon, Jun 17, 2024 at 11:34:32AM CEST, dan.carpenter@linaro.org wrote: >On 32bit systems, the "4 * max" multiply can overflow. Use kcalloc() >to do the allocation to prevent this. > >Fixes: 44c494c8e30e ("ptp: track available ptp vclocks information") >Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Jiri Pirko <jiri@nvidia.com>
在 2024/6/17 下午5:34, Dan Carpenter 写道: > On 32bit systems, the "4 * max" multiply can overflow. Use kcalloc() > to do the allocation to prevent this. > > Fixes: 44c494c8e30e ("ptp: track available ptp vclocks information") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- > v2: It's better to use kcalloc() instead of size_mul(). > > drivers/ptp/ptp_sysfs.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c > index a15460aaa03b..6b1b8f57cd95 100644 > --- a/drivers/ptp/ptp_sysfs.c > +++ b/drivers/ptp/ptp_sysfs.c > @@ -296,8 +296,7 @@ static ssize_t max_vclocks_store(struct device *dev, > if (max < ptp->n_vclocks) > goto out; > > - size = sizeof(int) * max; > - vclock_index = kzalloc(size, GFP_KERNEL); > + vclock_index = kcalloc(max, sizeof(int), GFP_KERNEL); > if (!vclock_index) { > err = -ENOMEM; > goto out; Reviewed-by: Heng Qi <hengqi@linux.alibaba.com> Thanks!
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Mon, 17 Jun 2024 12:34:32 +0300 you wrote: > On 32bit systems, the "4 * max" multiply can overflow. Use kcalloc() > to do the allocation to prevent this. > > Fixes: 44c494c8e30e ("ptp: track available ptp vclocks information") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- > v2: It's better to use kcalloc() instead of size_mul(). > > [...] Here is the summary with links: - [v2,net] ptp: fix integer overflow in max_vclocks_store https://git.kernel.org/netdev/net/c/81d23d2a2401 You are awesome, thank you!
diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c index a15460aaa03b..6b1b8f57cd95 100644 --- a/drivers/ptp/ptp_sysfs.c +++ b/drivers/ptp/ptp_sysfs.c @@ -296,8 +296,7 @@ static ssize_t max_vclocks_store(struct device *dev, if (max < ptp->n_vclocks) goto out; - size = sizeof(int) * max; - vclock_index = kzalloc(size, GFP_KERNEL); + vclock_index = kcalloc(max, sizeof(int), GFP_KERNEL); if (!vclock_index) { err = -ENOMEM; goto out;
On 32bit systems, the "4 * max" multiply can overflow. Use kcalloc() to do the allocation to prevent this. Fixes: 44c494c8e30e ("ptp: track available ptp vclocks information") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- v2: It's better to use kcalloc() instead of size_mul(). drivers/ptp/ptp_sysfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)