Messages in this thread | | | Subject | Re: [PATCH][next] rapidio/rio_mport_cdev: Use array_size() helper in copy_{from,to}_user() | From | "Gustavo A. R. Silva" <> | Date | Fri, 10 Jul 2020 17:06:42 -0500 |
| |
Hi all,
Friendly ping: who can take this, please?
Thanks -- Gustavo
On 6/16/20 13:30, Gustavo A. R. Silva wrote: > Use array_size() helper instead of the open-coded version in > copy_{from,to}_user(). These sorts of multiplication factors > need to be wrapped in array_size(). > > This issue was found with the help of Coccinelle and, audited > and fixed manually. > > Addresses-KSPP-ID: https://github.com/KSPP/linux/issues/83 > Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> > --- > drivers/rapidio/devices/rio_mport_cdev.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c > index 451608e960a1..6943459f8ac2 100644 > --- a/drivers/rapidio/devices/rio_mport_cdev.c > +++ b/drivers/rapidio/devices/rio_mport_cdev.c > @@ -981,7 +981,7 @@ static int rio_mport_transfer_ioctl(struct file *filp, void __user *arg) > > if (unlikely(copy_from_user(transfer, > (void __user *)(uintptr_t)transaction.block, > - transaction.count * sizeof(*transfer)))) { > + array_size(sizeof(*transfer), transaction.count)))) { > ret = -EFAULT; > goto out_free; > } > @@ -994,7 +994,7 @@ static int rio_mport_transfer_ioctl(struct file *filp, void __user *arg) > > if (unlikely(copy_to_user((void __user *)(uintptr_t)transaction.block, > transfer, > - transaction.count * sizeof(*transfer)))) > + array_size(sizeof(*transfer), transaction.count)))) > ret = -EFAULT; > > out_free: >
| |