@@ -81,8 +81,8 @@ struct xenbus_transaction_holder {
struct read_buffer {
struct list_head list;
unsigned int cons;
- unsigned int len;
- char msg[];
+ DECLARE_FLEX_ARRAY_ELEMENTS_COUNT(unsigned int, len);
+ DECLARE_FLEX_ARRAY_ELEMENTS(char, msg);
};
struct xenbus_file_priv {
@@ -188,21 +188,17 @@ static ssize_t xenbus_file_read(struct file *filp,
*/
static int queue_reply(struct list_head *queue, const void *data, size_t len)
{
- struct read_buffer *rb;
+ struct read_buffer *rb = NULL;
if (len == 0)
return 0;
if (len > XENSTORE_PAYLOAD_MAX)
return -EINVAL;
- rb = kmalloc(sizeof(*rb) + len, GFP_KERNEL);
- if (rb == NULL)
+ if (mem_to_flex_dup(&rb, data, len, GFP_KERNEL))
return -ENOMEM;
rb->cons = 0;
- rb->len = len;
-
- memcpy(rb->msg, data, len);
list_add_tail(&rb->list, queue);
return 0;
As part of the work to perform bounds checking on all memcpy() uses, replace the open-coded a deserialization of bytes out of memory into a trailing flexible array by using a flex_array.h helper to perform the allocation, bounds checking, and copying. Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com> Cc: Juergen Gross <jgross@suse.com> Cc: Stefano Stabellini <sstabellini@kernel.org> Cc: xen-devel@lists.xenproject.org Signed-off-by: Kees Cook <keescook@chromium.org> --- drivers/xen/xenbus/xenbus_dev_frontend.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)