diff mbox series

[next] RDMA/hfi1: Use struct_size() and flex_array_size() helpers

Message ID 20210927225333.GA192634@embeddedor (mailing list archive)
State Mainlined
Commit 11333be19c08b9277a87eb8c163217b8c362e91e
Headers show
Series [next] RDMA/hfi1: Use struct_size() and flex_array_size() helpers | expand

Commit Message

Gustavo A. R. Silva Sept. 27, 2021, 10:53 p.m. UTC
Make use of the struct_size() and flex_array_size() helpers instead of
open-coded versions, in order to avoid any potential type mistakes
or integer overflows that, in the worse scenario, could lead to heap
overflows.

Link: https://github.com/KSPP/linux/issues/160
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
 drivers/infiniband/hw/hfi1/user_exp_rcv.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

Comments

Jason Gunthorpe Sept. 27, 2021, 11:36 p.m. UTC | #1
On Mon, Sep 27, 2021 at 05:53:33PM -0500, Gustavo A. R. Silva wrote:
> Make use of the struct_size() and flex_array_size() helpers instead of
> open-coded versions, in order to avoid any potential type mistakes
> or integer overflows that, in the worse scenario, could lead to heap
> overflows.
> 
> Link: https://github.com/KSPP/linux/issues/160
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> ---
>  drivers/infiniband/hw/hfi1/user_exp_rcv.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)

Applied to for-next, thanks

Jason
Gustavo A. R. Silva Sept. 27, 2021, 11:50 p.m. UTC | #2
On Mon, Sep 27, 2021 at 08:36:50PM -0300, Jason Gunthorpe wrote:
> 
> Applied to for-next, thanks

Thanks, Jason.
--
Gustavo
diff mbox series

Patch

diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
index 0c86e9d354f8..186d30291260 100644
--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
@@ -692,8 +692,7 @@  static int set_rcvarray_entry(struct hfi1_filedata *fd,
 	 * Allocate the node first so we can handle a potential
 	 * failure before we've programmed anything.
 	 */
-	node = kzalloc(sizeof(*node) + (sizeof(struct page *) * npages),
-		       GFP_KERNEL);
+	node = kzalloc(struct_size(node, pages, npages), GFP_KERNEL);
 	if (!node)
 		return -ENOMEM;
 
@@ -713,7 +712,7 @@  static int set_rcvarray_entry(struct hfi1_filedata *fd,
 	node->dma_addr = phys;
 	node->grp = grp;
 	node->freed = false;
-	memcpy(node->pages, pages, sizeof(struct page *) * npages);
+	memcpy(node->pages, pages, flex_array_size(node, pages, npages));
 
 	if (fd->use_mn) {
 		ret = mmu_interval_notifier_insert(