@@ -202,9 +202,9 @@ struct ffs_epfile {
};
struct ffs_buffer {
- size_t length;
+ DECLARE_FLEX_ARRAY_ELEMENTS_COUNT(size_t, length);
char *data;
- char storage[];
+ DECLARE_FLEX_ARRAY_ELEMENTS(char, storage);
};
/* ffs_io_data structure ***************************************************/
@@ -905,7 +905,7 @@ static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile,
void *data, int data_len,
struct iov_iter *iter)
{
- struct ffs_buffer *buf;
+ struct ffs_buffer *buf = NULL;
ssize_t ret = copy_to_iter(data, data_len, iter);
if (data_len == ret)
@@ -919,12 +919,9 @@ static ssize_t __ffs_epfile_read_data(struct ffs_epfile *epfile,
data_len, ret);
data_len -= ret;
- buf = kmalloc(struct_size(buf, storage, data_len), GFP_KERNEL);
- if (!buf)
+ if (mem_to_flex_dup(&buf, data + ret, data_len, GFP_KERNEL))
return -ENOMEM;
- buf->length = data_len;
buf->data = buf->storage;
- memcpy(buf->storage, data + ret, flex_array_size(buf, storage, data_len));
/*
* At this point read_buffer is NULL or READ_BUFFER_DROP (if
As part of the work to perform bounds checking on all memcpy() uses, replace the open-coded a deserialization of bytes out of memory into a trailing flexible array by using a flex_array.h helper to perform the allocation, bounds checking, and copying. Cc: Felipe Balbi <balbi@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Eugeniu Rosca <erosca@de.adit-jv.com> Cc: John Keeping <john@metanate.com> Cc: Jens Axboe <axboe@kernel.dk> Cc: Udipto Goswami <quic_ugoswami@quicinc.com> Cc: Andrew Gabbasov <andrew_gabbasov@mentor.com> Cc: linux-usb@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> --- drivers/usb/gadget/function/f_fs.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)