| Message ID | 20220207233923.GA524723@embeddedor (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 2a3950c43e2ead47ed7456b04da5d4afde58c4b2 |
| Headers | show |
| Series | [next] nouveau/svm: Use struct_size() helper in nouveau_pfns_map() | expand |
Reviewed-by: Lyude Paul <lyude@redhat.com> Will push this to drm-misc-next, thanks! On Mon, 2022-02-07 at 17:39 -0600, Gustavo A. R. Silva wrote: > Make use of the struct_size() helper instead of an open-coded version, > in order to avoid any potential type mistakes or integer overflows that, > in the worse scenario, could lead to heap overflows. > > Link: https://github.com/KSPP/linux/issues/160 > Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> > --- > drivers/gpu/drm/nouveau/nouveau_svm.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c > b/drivers/gpu/drm/nouveau/nouveau_svm.c > index 266809e511e2..46a5a1016e37 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_svm.c > +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c > @@ -925,8 +925,8 @@ nouveau_pfns_map(struct nouveau_svmm *svmm, struct > mm_struct *mm, > > mutex_lock(&svmm->mutex); > > - ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) > + > - npages * sizeof(args->p.phys[0]), NULL); > + ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, > + struct_size(args, p.phys, npages), NULL); > > mutex_unlock(&svmm->mutex); > }
diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c index 266809e511e2..46a5a1016e37 100644 --- a/drivers/gpu/drm/nouveau/nouveau_svm.c +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c @@ -925,8 +925,8 @@ nouveau_pfns_map(struct nouveau_svmm *svmm, struct mm_struct *mm, mutex_lock(&svmm->mutex); - ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) + - npages * sizeof(args->p.phys[0]), NULL); + ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, + struct_size(args, p.phys, npages), NULL); mutex_unlock(&svmm->mutex); }
Make use of the struct_size() helper instead of an open-coded version, in order to avoid any potential type mistakes or integer overflows that, in the worse scenario, could lead to heap overflows. Link: https://github.com/KSPP/linux/issues/160 Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> --- drivers/gpu/drm/nouveau/nouveau_svm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)