* [PATCH][next] vfio/iommu_type1: Use struct_size() for kzalloc()
@ 2021-05-13 23:01 Gustavo A. R. Silva
2021-05-24 19:48 ` Alex Williamson
0 siblings, 1 reply; 3+ messages in thread
From: Gustavo A. R. Silva @ 2021-05-13 23:01 UTC (permalink / raw)
To: Alex Williamson, Cornelia Huck
Cc: kvm, linux-kernel, Gustavo A. R. Silva, linux-hardening
Make use of the struct_size() helper instead of an open-coded version,
in order to avoid any potential type mistakes or integer overflows
that, in the worst scenario, could lead to heap overflows.
This code was detected with the help of Coccinelle and, audited and
fixed manually.
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
drivers/vfio/vfio_iommu_type1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index a0747c35a778..a3e925a41b0d 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -2795,7 +2795,7 @@ static int vfio_iommu_iova_build_caps(struct vfio_iommu *iommu,
return 0;
}
- size = sizeof(*cap_iovas) + (iovas * sizeof(*cap_iovas->iova_ranges));
+ size = struct_size(cap_iovas, iova_ranges, iovas);
cap_iovas = kzalloc(size, GFP_KERNEL);
if (!cap_iovas)
--
2.27.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH][next] vfio/iommu_type1: Use struct_size() for kzalloc()
2021-05-13 23:01 [PATCH][next] vfio/iommu_type1: Use struct_size() for kzalloc() Gustavo A. R. Silva
@ 2021-05-24 19:48 ` Alex Williamson
2021-05-24 19:59 ` Gustavo A. R. Silva
0 siblings, 1 reply; 3+ messages in thread
From: Alex Williamson @ 2021-05-24 19:48 UTC (permalink / raw)
To: Gustavo A. R. Silva; +Cc: Cornelia Huck, kvm, linux-kernel, linux-hardening
On Thu, 13 May 2021 18:01:55 -0500
"Gustavo A. R. Silva" <gustavoars@kernel.org> wrote:
> Make use of the struct_size() helper instead of an open-coded version,
> in order to avoid any potential type mistakes or integer overflows
> that, in the worst scenario, could lead to heap overflows.
>
> This code was detected with the help of Coccinelle and, audited and
> fixed manually.
>
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> ---
> drivers/vfio/vfio_iommu_type1.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
> index a0747c35a778..a3e925a41b0d 100644
> --- a/drivers/vfio/vfio_iommu_type1.c
> +++ b/drivers/vfio/vfio_iommu_type1.c
> @@ -2795,7 +2795,7 @@ static int vfio_iommu_iova_build_caps(struct vfio_iommu *iommu,
> return 0;
> }
>
> - size = sizeof(*cap_iovas) + (iovas * sizeof(*cap_iovas->iova_ranges));
> + size = struct_size(cap_iovas, iova_ranges, iovas);
>
> cap_iovas = kzalloc(size, GFP_KERNEL);
> if (!cap_iovas)
Looks good, applied to vfio for-linus branch for v5.13. Thanks,
Alex
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH][next] vfio/iommu_type1: Use struct_size() for kzalloc()
2021-05-24 19:48 ` Alex Williamson
@ 2021-05-24 19:59 ` Gustavo A. R. Silva
0 siblings, 0 replies; 3+ messages in thread
From: Gustavo A. R. Silva @ 2021-05-24 19:59 UTC (permalink / raw)
To: Alex Williamson, Gustavo A. R. Silva
Cc: Cornelia Huck, kvm, linux-kernel, linux-hardening
On 5/24/21 14:48, Alex Williamson wrote:
> Looks good, applied to vfio for-linus branch for v5.13. Thanks,
Thanks, Alex. :)
--
Gustavo
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-05-24 19:59 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-13 23:01 [PATCH][next] vfio/iommu_type1: Use struct_size() for kzalloc() Gustavo A. R. Silva
2021-05-24 19:48 ` Alex Williamson
2021-05-24 19:59 ` Gustavo A. R. Silva
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).