lkml.org 
[lkml]   [2021]   [May]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH][next] vfio/iommu_type1: Use struct_size() for kzalloc()
On Thu, 13 May 2021 18:01:55 -0500
"Gustavo A. R. Silva" <gustavoars@kernel.org> wrote:

> Make use of the struct_size() helper instead of an open-coded version,
> in order to avoid any potential type mistakes or integer overflows
> that, in the worst scenario, could lead to heap overflows.
>
> This code was detected with the help of Coccinelle and, audited and
> fixed manually.
>
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> ---
> drivers/vfio/vfio_iommu_type1.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
> index a0747c35a778..a3e925a41b0d 100644
> --- a/drivers/vfio/vfio_iommu_type1.c
> +++ b/drivers/vfio/vfio_iommu_type1.c
> @@ -2795,7 +2795,7 @@ static int vfio_iommu_iova_build_caps(struct vfio_iommu *iommu,
> return 0;
> }
>
> - size = sizeof(*cap_iovas) + (iovas * sizeof(*cap_iovas->iova_ranges));
> + size = struct_size(cap_iovas, iova_ranges, iovas);
>
> cap_iovas = kzalloc(size, GFP_KERNEL);
> if (!cap_iovas)


Looks good, applied to vfio for-linus branch for v5.13. Thanks,

Alex

\
 
 \ /
  Last update: 2021-05-24 21:48    [W:0.060 / U:0.564 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site