linux-kernel - Re: [PATCH] drm: amdgpu: Use the correct size when allocating memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200810154213.GM1793@kadam>
Date:   Mon, 10 Aug 2020 18:42:13 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Christophe JAILLET <christophe.jaillet@...adoo.fr>
Cc:     alexander.deucher@....com, christian.koenig@....com,
        airlied@...ux.ie, daniel@...ll.ch, sumit.semwal@...aro.org,
        colton.w.lewis@...tonmail.com, Ori.Messinger@....com,
        m.szyprowski@...sung.com, bernard@...o.com,
        dri-devel@...ts.freedesktop.org, amd-gfx@...ts.freedesktop.org,
        linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] drm: amdgpu: Use the correct size when allocating memory

On Sun, Aug 09, 2020 at 10:34:06PM +0200, Christophe JAILLET wrote:
> When '*sgt' is allocated, we must allocated 'sizeof(**sgt)' bytes instead
> of 'sizeof(*sg)'. 'sg' (i.e. struct scatterlist) is smaller than
> 'sgt' (i.e struct sg_table), so this could lead to memory corruption.

The sizeof(*sg) is bigger than sizeof(**sgt) so this wastes memory but
it won't lead to corruption.

    11  struct scatterlist {
    12          unsigned long   page_link;
    13          unsigned int    offset;
    14          unsigned int    length;
    15          dma_addr_t      dma_address;
    16  #ifdef CONFIG_NEED_SG_DMA_LENGTH
    17          unsigned int    dma_length;
    18  #endif
    19  };

    42  struct sg_table {
    43          struct scatterlist *sgl;        /* the list */
    44          unsigned int nents;             /* number of mapped entries */
    45          unsigned int orig_nents;        /* original size of list */
    46  };

regards,
dan carpenter