linux-block.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH][next] rsxx: Use struct_size() in vmalloc()
@ 2021-05-13 20:37 Gustavo A. R. Silva
  2021-05-14 15:00 ` Jens Axboe
  0 siblings, 1 reply; 3+ messages in thread
From: Gustavo A. R. Silva @ 2021-05-13 20:37 UTC (permalink / raw)
  To: Joshua Morris, Philip Kelleher, Jens Axboe
  Cc: linux-block, linux-kernel, Gustavo A. R. Silva, linux-hardening

Make use of the struct_size() helper instead of an open-coded version,
in order to avoid any potential type mistakes or integer overflows
that, in the worst scenario, could lead to heap overflows.

This code was detected with the help of Coccinelle and, audited and
fixed manually.

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
 drivers/block/rsxx/dma.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/block/rsxx/dma.c b/drivers/block/rsxx/dma.c
index 0574f4495755..ed182f3dd054 100644
--- a/drivers/block/rsxx/dma.c
+++ b/drivers/block/rsxx/dma.c
@@ -74,9 +74,6 @@ struct dma_tracker {
 	struct rsxx_dma	*dma;
 };
 
-#define DMA_TRACKER_LIST_SIZE8 (sizeof(struct dma_tracker_list) + \
-		(sizeof(struct dma_tracker) * RSXX_MAX_OUTSTANDING_CMDS))
-
 struct dma_tracker_list {
 	spinlock_t		lock;
 	int			head;
@@ -808,7 +805,8 @@ static int rsxx_dma_ctrl_init(struct pci_dev *dev,
 
 	memset(&ctrl->stats, 0, sizeof(ctrl->stats));
 
-	ctrl->trackers = vmalloc(DMA_TRACKER_LIST_SIZE8);
+	ctrl->trackers = vmalloc(struct_size(ctrl->trackers, list,
+					     RSXX_MAX_OUTSTANDING_CMDS));
 	if (!ctrl->trackers)
 		return -ENOMEM;
 
-- 
2.27.0


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH][next] rsxx: Use struct_size() in vmalloc()
  2021-05-13 20:37 [PATCH][next] rsxx: Use struct_size() in vmalloc() Gustavo A. R. Silva
@ 2021-05-14 15:00 ` Jens Axboe
  2021-05-15  0:03   ` Gustavo A. R. Silva
  0 siblings, 1 reply; 3+ messages in thread
From: Jens Axboe @ 2021-05-14 15:00 UTC (permalink / raw)
  To: Gustavo A. R. Silva, Joshua Morris, Philip Kelleher
  Cc: linux-block, linux-kernel, linux-hardening

On 5/13/21 2:37 PM, Gustavo A. R. Silva wrote:
> Make use of the struct_size() helper instead of an open-coded version,
> in order to avoid any potential type mistakes or integer overflows
> that, in the worst scenario, could lead to heap overflows.
> 
> This code was detected with the help of Coccinelle and, audited and
> fixed manually.

Applied, thanks.

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH][next] rsxx: Use struct_size() in vmalloc()
  2021-05-14 15:00 ` Jens Axboe
@ 2021-05-15  0:03   ` Gustavo A. R. Silva
  0 siblings, 0 replies; 3+ messages in thread
From: Gustavo A. R. Silva @ 2021-05-15  0:03 UTC (permalink / raw)
  To: Jens Axboe, Gustavo A. R. Silva, Joshua Morris, Philip Kelleher
  Cc: linux-block, linux-kernel, linux-hardening



On 5/14/21 10:00, Jens Axboe wrote:

> 
> Applied, thanks.
> 

Thanks, Jens.

--
Gustavo

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-05-15  0:03 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-13 20:37 [PATCH][next] rsxx: Use struct_size() in vmalloc() Gustavo A. R. Silva
2021-05-14 15:00 ` Jens Axboe
2021-05-15  0:03   ` Gustavo A. R. Silva

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).