linux-hardening - Re: [PATCH][next] usb: dwc2: Use flex_array

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d1ec4e8a-574a-d841-850c-3f136e404d1a@synopsys.com>
Date:   Fri, 14 Jan 2022 18:50:54 +0000
From:   Thinh Nguyen <Thinh.Nguyen@...opsys.com>
To:     "Gustavo A. R. Silva" <gustavoars@...nel.org>,
        Minas Harutyunyan <Minas.Harutyunyan@...opsys.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC:     "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-hardening@...r.kernel.org" <linux-hardening@...r.kernel.org>
Subject: Re: [PATCH][next] usb: dwc2: Use flex_array_size() helper

Hi,

Gustavo A. R. Silva wrote:
> Make use of the flex_array_size() helper to calculate the size of a
> flexible array member within an enclosing structure.
> 
> This helper offers defense-in-depth against potential integer
> overflows, while at the same time makes it explicitly clear that
> we are dealing with a flexible array member.
> 
> Link: https://urldefense.com/v3/__https://github.com/KSPP/linux/issues/160__;!!A4F2R9G_pg!L8p7TlfbH0sNpL9gtsVuWEZVnP8euMZtJKpc71sXxzEw4MAKWuQ28dJJc0cJTI3bWXLm$ 
> Signed-off-by: Gustavo A. R. Silva <gustavoars@...nel.org>
> ---
>  drivers/usb/dwc2/hcd.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
> index f63a27d11fac..2c21498662cd 100644
> --- a/drivers/usb/dwc2/hcd.c
> +++ b/drivers/usb/dwc2/hcd.c
> @@ -4054,8 +4054,9 @@ struct dwc2_tt *dwc2_host_get_tt_info(struct dwc2_hsotg *hsotg, void *context,
>  			 * For single_tt we need one schedule.  For multi_tt
>  			 * we need one per port.
>  			 */
> -			bitmap_size = DWC2_ELEMENTS_PER_LS_BITMAP *
> -				      sizeof(dwc_tt->periodic_bitmaps[0]);
> +			bitmap_size =
> +				flex_array_size(dwc_tt, periodic_bitmaps,
> +						DWC2_ELEMENTS_PER_LS_BITMAP);
>  			if (urb->dev->tt->multi)
>  				bitmap_size *= urb->dev->tt->hub->maxchild;
>  

This doesn't look right even though the result will be the same. The
return value from flex_array_size() may not be the final array size as you
can see that bitmap_size gets updated again a couple lines down.

How about this instead:

diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index f63a27d11fac..0936ff8b57db 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -4048,18 +4048,17 @@ struct dwc2_tt *dwc2_host_get_tt_info(struct dwc2_hsotg *hsotg, void *context,
 
                dwc_tt = urb->dev->tt->hcpriv;
                if (!dwc_tt) {
-                       size_t bitmap_size;
+                       int count;
 
                        /*
                         * For single_tt we need one schedule.  For multi_tt
                         * we need one per port.
                         */
-                       bitmap_size = DWC2_ELEMENTS_PER_LS_BITMAP *
-                                     sizeof(dwc_tt->periodic_bitmaps[0]);
+                       count = DWC2_ELEMENTS_PER_LS_BITMAP;
                        if (urb->dev->tt->multi)
-                               bitmap_size *= urb->dev->tt->hub->maxchild;
+                               count *= urb->dev->tt->hub->maxchild;
 
-                       dwc_tt = kzalloc(sizeof(*dwc_tt) + bitmap_size,
+                       dwc_tt = kzalloc(struct_size(dwc_tt, periodic_bitmaps, count),
                                         mem_flags);
                        if (!dwc_tt)
                                return NULL;


BR,
Thinh