* [PATCH][next] ethtool: ioctl: Use array_size() in copy_to_user()
@ 2020-06-15 23:01 Gustavo A. R. Silva
2020-06-17 22:05 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Gustavo A. R. Silva @ 2020-06-15 23:01 UTC (permalink / raw)
To: David S. Miller, Jakub Kicinski
Cc: netdev, linux-kernel, Gustavo A. R. Silva, Kees Cook
Use array_size() helper instead of the open-coded version in
copy_to_user(). These sorts of multiplication factors need to
be wrapped in array_size().
This issue was found with the help of Coccinelle and, audited and fixed
manually.
Addresses-KSPP-ID: https://github.com/KSPP/linux/issues/83
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
net/ethtool/ioctl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c
index b5df90c981c2..be3ed24bfe03 100644
--- a/net/ethtool/ioctl.c
+++ b/net/ethtool/ioctl.c
@@ -1918,7 +1918,7 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr)
if (copy_to_user(useraddr, &stats, sizeof(stats)))
goto out;
useraddr += sizeof(stats);
- if (n_stats && copy_to_user(useraddr, data, n_stats * sizeof(u64)))
+ if (n_stats && copy_to_user(useraddr, data, array_size(n_stats, sizeof(u64))))
goto out;
ret = 0;
@@ -1973,7 +1973,7 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
if (copy_to_user(useraddr, &stats, sizeof(stats)))
goto out;
useraddr += sizeof(stats);
- if (n_stats && copy_to_user(useraddr, data, n_stats * sizeof(u64)))
+ if (n_stats && copy_to_user(useraddr, data, array_size(n_stats, sizeof(u64))))
goto out;
ret = 0;
--
2.27.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH][next] ethtool: ioctl: Use array_size() in copy_to_user()
2020-06-15 23:01 [PATCH][next] ethtool: ioctl: Use array_size() in copy_to_user() Gustavo A. R. Silva
@ 2020-06-17 22:05 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2020-06-17 22:05 UTC (permalink / raw)
To: gustavoars; +Cc: kuba, netdev, linux-kernel, gustavo, keescook
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Mon, 15 Jun 2020 18:01:07 -0500
> Use array_size() helper instead of the open-coded version in
> copy_to_user(). These sorts of multiplication factors need to
> be wrapped in array_size().
>
> This issue was found with the help of Coccinelle and, audited and fixed
> manually.
>
> Addresses-KSPP-ID: https://github.com/KSPP/linux/issues/83
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Applied to net-next.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-06-17 22:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-15 23:01 [PATCH][next] ethtool: ioctl: Use array_size() in copy_to_user() Gustavo A. R. Silva
2020-06-17 22:05 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).