All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] ARC: unwind: Use struct_size helper instead of open-coded arithmetic
@ 2021-07-16 17:03 ` Len Baker
  0 siblings, 0 replies; 4+ messages in thread
From: Len Baker @ 2021-07-16 17:03 UTC (permalink / raw)
  To: Vineet Gupta
  Cc: Len Baker, dean.yang_cp, Gustavo A. R. Silva, linux-snps-arc,
	linux-kernel

Dynamic size calculations (especially multiplication) should not be
performed in memory allocator function arguments due to the risk of them
overflowing. This could lead to values wrapping around and a smaller
allocation being made than the caller was expecting. Using those
allocations could lead to linear overflows of heap memory and other
misbehaviors.

To avoid this scenario, use the struct_size helper.

Signed-off-by: Len Baker <len.baker@gmx.com>
---
 arch/arc/kernel/unwind.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
index 47bab67f8649..af18052b86a7 100644
--- a/arch/arc/kernel/unwind.c
+++ b/arch/arc/kernel/unwind.c
@@ -13,6 +13,7 @@
 #include <linux/sched.h>
 #include <linux/module.h>
 #include <linux/memblock.h>
+#include <linux/overflow.h>
 #include <linux/sort.h>
 #include <linux/slab.h>
 #include <linux/stop_machine.h>
@@ -312,9 +313,7 @@ static void init_unwind_hdr(struct unwind_table *table,
 	if (tableSize || !n)
 		goto ret_err;

-	hdrSize = 4 + sizeof(unsigned long) + sizeof(unsigned int)
-	    + 2 * n * sizeof(unsigned long);
-
+	hdrSize = struct_size(header, table, n);
 	header = alloc(hdrSize);
 	if (!header)
 		goto ret_err;
--
2.25.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread
* [PATCH] ARC: unwind: Use struct_size helper instead of open-coded arithmetic
@ 2021-07-16 17:03 ` Len Baker
  0 siblings, 0 replies; 4+ messages in thread
From: Len Baker @ 2021-07-16 17:03 UTC (permalink / raw)
  To: Vineet Gupta
  Cc: Len Baker, dean.yang_cp, Gustavo A. R. Silva, linux-snps-arc,
	linux-kernel

Dynamic size calculations (especially multiplication) should not be
performed in memory allocator function arguments due to the risk of them
overflowing. This could lead to values wrapping around and a smaller
allocation being made than the caller was expecting. Using those
allocations could lead to linear overflows of heap memory and other
misbehaviors.

To avoid this scenario, use the struct_size helper.

Signed-off-by: Len Baker <len.baker@gmx.com>
---
 arch/arc/kernel/unwind.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
index 47bab67f8649..af18052b86a7 100644
--- a/arch/arc/kernel/unwind.c
+++ b/arch/arc/kernel/unwind.c
@@ -13,6 +13,7 @@
 #include <linux/sched.h>
 #include <linux/module.h>
 #include <linux/memblock.h>
+#include <linux/overflow.h>
 #include <linux/sort.h>
 #include <linux/slab.h>
 #include <linux/stop_machine.h>
@@ -312,9 +313,7 @@ static void init_unwind_hdr(struct unwind_table *table,
 	if (tableSize || !n)
 		goto ret_err;

-	hdrSize = 4 + sizeof(unsigned long) + sizeof(unsigned int)
-	    + 2 * n * sizeof(unsigned long);
-
+	hdrSize = struct_size(header, table, n);
 	header = alloc(hdrSize);
 	if (!header)
 		goto ret_err;
--
2.25.1


_______________________________________________
linux-snps-arc mailing list
linux-snps-arc@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-snps-arc

^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: [PATCH] ARC: unwind: Use struct_size helper instead of open-coded arithmetic
  2021-07-16 17:03 ` Len Baker
@ 2021-07-16 19:41   ` Gustavo A. R. Silva
  -1 siblings, 0 replies; 4+ messages in thread
From: Gustavo A. R. Silva @ 2021-07-16 19:41 UTC (permalink / raw)
  To: Len Baker, Vineet Gupta
  Cc: dean.yang_cp, Gustavo A. R. Silva, linux-snps-arc, linux-kernel



On 7/16/21 12:03, Len Baker wrote:
> Dynamic size calculations (especially multiplication) should not be
> performed in memory allocator function arguments due to the risk of them
> overflowing. This could lead to values wrapping around and a smaller
> allocation being made than the caller was expecting. Using those
> allocations could lead to linear overflows of heap memory and other
> misbehaviors.
> 
> To avoid this scenario, use the struct_size helper.
> 
> Signed-off-by: Len Baker <len.baker@gmx.com>

Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>

Thanks!
--
Gustavo

> ---
>  arch/arc/kernel/unwind.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
> index 47bab67f8649..af18052b86a7 100644
> --- a/arch/arc/kernel/unwind.c
> +++ b/arch/arc/kernel/unwind.c
> @@ -13,6 +13,7 @@
>  #include <linux/sched.h>
>  #include <linux/module.h>
>  #include <linux/memblock.h>
> +#include <linux/overflow.h>
>  #include <linux/sort.h>
>  #include <linux/slab.h>
>  #include <linux/stop_machine.h>
> @@ -312,9 +313,7 @@ static void init_unwind_hdr(struct unwind_table *table,
>  	if (tableSize || !n)
>  		goto ret_err;
> 
> -	hdrSize = 4 + sizeof(unsigned long) + sizeof(unsigned int)
> -	    + 2 * n * sizeof(unsigned long);
> -
> +	hdrSize = struct_size(header, table, n);
>  	header = alloc(hdrSize);
>  	if (!header)
>  		goto ret_err;
> --
> 2.25.1
> 

^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [PATCH] ARC: unwind: Use struct_size helper instead of open-coded arithmetic
@ 2021-07-16 19:41   ` Gustavo A. R. Silva
  0 siblings, 0 replies; 4+ messages in thread
From: Gustavo A. R. Silva @ 2021-07-16 19:41 UTC (permalink / raw)
  To: Len Baker, Vineet Gupta
  Cc: dean.yang_cp, Gustavo A. R. Silva, linux-snps-arc, linux-kernel



On 7/16/21 12:03, Len Baker wrote:
> Dynamic size calculations (especially multiplication) should not be
> performed in memory allocator function arguments due to the risk of them
> overflowing. This could lead to values wrapping around and a smaller
> allocation being made than the caller was expecting. Using those
> allocations could lead to linear overflows of heap memory and other
> misbehaviors.
> 
> To avoid this scenario, use the struct_size helper.
> 
> Signed-off-by: Len Baker <len.baker@gmx.com>

Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>

Thanks!
--
Gustavo

> ---
>  arch/arc/kernel/unwind.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
> index 47bab67f8649..af18052b86a7 100644
> --- a/arch/arc/kernel/unwind.c
> +++ b/arch/arc/kernel/unwind.c
> @@ -13,6 +13,7 @@
>  #include <linux/sched.h>
>  #include <linux/module.h>
>  #include <linux/memblock.h>
> +#include <linux/overflow.h>
>  #include <linux/sort.h>
>  #include <linux/slab.h>
>  #include <linux/stop_machine.h>
> @@ -312,9 +313,7 @@ static void init_unwind_hdr(struct unwind_table *table,
>  	if (tableSize || !n)
>  		goto ret_err;
> 
> -	hdrSize = 4 + sizeof(unsigned long) + sizeof(unsigned int)
> -	    + 2 * n * sizeof(unsigned long);
> -
> +	hdrSize = struct_size(header, table, n);
>  	header = alloc(hdrSize);
>  	if (!header)
>  		goto ret_err;
> --
> 2.25.1
> 

_______________________________________________
linux-snps-arc mailing list
linux-snps-arc@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-snps-arc

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-07-16 19:39 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-16 17:03 [PATCH] ARC: unwind: Use struct_size helper instead of open-coded arithmetic Len Baker
2021-07-16 17:03 ` Len Baker
2021-07-16 19:41 ` Gustavo A. R. Silva
2021-07-16 19:41   ` Gustavo A. R. Silva

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.