lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <df8f30c2-7a94-110d-cc99-876979ec28c3@embeddedor.com> Date: Fri, 15 Sep 2023 12:56:34 -0600 From: "Gustavo A. R. Silva" <gustavo@...eddedor.com> To: Kees Cook <keescook@...omium.org>, "Gustavo A. R. Silva" <gustavoars@...nel.org> Cc: Noralf Trønnes <noralf@...nnes.org>, David Airlie <airlied@...il.com>, Daniel Vetter <daniel@...ll.ch>, Peter Stuge <peter@...ge.se>, dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org Subject: Re: [PATCH][next] drm/gud: Use size_add() in call to struct_size() On 9/15/23 12:52, Kees Cook wrote: > On Fri, Sep 15, 2023 at 12:43:20PM -0600, Gustavo A. R. Silva wrote: >> If, for any reason, the open-coded arithmetic causes a wraparound, the >> protection that `struct_size()` adds against potential integer overflows >> is defeated. Fix this by hardening call to `struct_size()` with `size_add()`. >> >> Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver") >> Signed-off-by: Gustavo A. R. Silva <gustavoars@...nel.org> >> --- >> drivers/gpu/drm/gud/gud_pipe.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/gpu/drm/gud/gud_pipe.c b/drivers/gpu/drm/gud/gud_pipe.c >> index d2f199ea3c11..a02f75be81f0 100644 >> --- a/drivers/gpu/drm/gud/gud_pipe.c >> +++ b/drivers/gpu/drm/gud/gud_pipe.c >> @@ -503,7 +503,7 @@ int gud_pipe_check(struct drm_simple_display_pipe *pipe, >> return -ENOENT; >> >> len = struct_size(req, properties, >> - GUD_PROPERTIES_MAX_NUM + GUD_CONNECTOR_PROPERTIES_MAX_NUM); >> + size_add(GUD_PROPERTIES_MAX_NUM, GUD_CONNECTOR_PROPERTIES_MAX_NUM)); > > There are both constant expressions, so there's not too much value in > wrapping them with size_add(), but for maintaining a common coding style > for dealing with allocation sizes, I can be convinced of the change. :) Yep; I've found a mix of constant expressions and variables doing open-coded arithmetic in `struct_size()`, so I'm sending them all. > > Reviewed-by: Kees Cook <keescook@...omium.org> Thanks! -- Gustavo > > >> req = kzalloc(len, GFP_KERNEL); >> if (!req) >> return -ENOMEM; >> -- >> 2.34.1 >> >
Powered by blists - more mailing lists