lkml.org 
[lkml]   [2021]   [Oct]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v3][next] virt: acrn: Prefer array_size and struct_size over open coded arithmetic
Date
As noted in the "Deprecated Interfaces, Language Features, Attributes,
and Conventions" documentation [1], size calculations (especially
multiplication) should not be performed in memory allocator (or similar)
function arguments due to the risk of them overflowing. This could lead
to values wrapping around and a smaller allocation being made than the
caller was expecting. Using those allocations could lead to linear
overflows of heap memory and other misbehaviors.

So, use the array_size() helper to do the arithmetic instead of the
argument "count * size" in the vzalloc() function.

Also, take the opportunity to add a flexible array member of struct
vm_memory_region_op to the vm_memory_region_batch structure. And then,
change the code accordingly and use the struct_size() helper to do the
arithmetic instead of the argument "size + size * count" in the kzalloc
function.

This code was detected with the help of Coccinelle and audited and fixed
manually.

[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments

Acked-by: Fei Li <fei1.li@intel.com>
Signed-off-by: Len Baker <len.baker@gmx.com>
---
Changelog v1 -> v2
- Fix the typo "syze -> size" in the subject (Kees Cook).
- Reduce the number of tabs in the definition of the structure
vm_memory_region_batch (Fei Li).
- Add the "Acked-by" tag.

Changelog v2 -> v3
- Use the variable instead of the struct name in the sizeof()
function used in the array_size() function.

drivers/virt/acrn/acrn_drv.h | 10 ++++++----
drivers/virt/acrn/mm.c | 9 ++++-----
2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/virt/acrn/acrn_drv.h b/drivers/virt/acrn/acrn_drv.h
index 1be54efa666c..5663c17ad37c 100644
--- a/drivers/virt/acrn/acrn_drv.h
+++ b/drivers/virt/acrn/acrn_drv.h
@@ -48,6 +48,7 @@ struct vm_memory_region_op {
* @reserved: Reserved.
* @regions_num: The number of vm_memory_region_op.
* @regions_gpa: Physical address of a vm_memory_region_op array.
+ * @regions_op: Flexible array of vm_memory_region_op.
*
* HC_VM_SET_MEMORY_REGIONS uses this structure to manage EPT mappings of
* multiple memory regions of a User VM. A &struct vm_memory_region_batch
@@ -55,10 +56,11 @@ struct vm_memory_region_op {
* ACRN Hypervisor.
*/
struct vm_memory_region_batch {
- u16 vmid;
- u16 reserved[3];
- u32 regions_num;
- u64 regions_gpa;
+ u16 vmid;
+ u16 reserved[3];
+ u32 regions_num;
+ u64 regions_gpa;
+ struct vm_memory_region_op regions_op[];
};

/**
diff --git a/drivers/virt/acrn/mm.c b/drivers/virt/acrn/mm.c
index c4f2e15c8a2b..ba241a24c48e 100644
--- a/drivers/virt/acrn/mm.c
+++ b/drivers/virt/acrn/mm.c
@@ -168,7 +168,7 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap)

/* Get the page number of the map region */
nr_pages = memmap->len >> PAGE_SHIFT;
- pages = vzalloc(nr_pages * sizeof(struct page *));
+ pages = vzalloc(array_size(nr_pages, sizeof(*pages)));
if (!pages)
return -ENOMEM;

@@ -220,16 +220,15 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap)
}

/* Prepare the vm_memory_region_batch */
- regions_info = kzalloc(sizeof(*regions_info) +
- sizeof(*vm_region) * nr_regions,
- GFP_KERNEL);
+ regions_info = kzalloc(struct_size(regions_info, regions_op,
+ nr_regions), GFP_KERNEL);
if (!regions_info) {
ret = -ENOMEM;
goto unmap_kernel_map;
}

/* Fill each vm_memory_region_op */
- vm_region = (struct vm_memory_region_op *)(regions_info + 1);
+ vm_region = regions_info->regions_op;
regions_info->vmid = vm->vmid;
regions_info->regions_num = nr_regions;
regions_info->regions_gpa = virt_to_phys(vm_region);
--
2.25.1
\
 
 \ /
  Last update: 2021-10-29 19:28    [W:0.035 / U:1.596 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site