linux-kernel - [PATCH] ARC: unwind: Use struct_size helper instead of open-coded arithmetic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210716170344.9150-1-len.baker@gmx.com>
Date:   Fri, 16 Jul 2021 19:03:44 +0200
From:   Len Baker <len.baker@....com>
To:     Vineet Gupta <vgupta@...opsys.com>
Cc:     Len Baker <len.baker@....com>,
        "dean.yang_cp" <yangdianqing@...ong.com>,
        "Gustavo A. R. Silva" <gustavoars@...nel.org>,
        linux-snps-arc@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: [PATCH] ARC: unwind: Use struct_size helper instead of open-coded arithmetic

Dynamic size calculations (especially multiplication) should not be
performed in memory allocator function arguments due to the risk of them
overflowing. This could lead to values wrapping around and a smaller
allocation being made than the caller was expecting. Using those
allocations could lead to linear overflows of heap memory and other
misbehaviors.

To avoid this scenario, use the struct_size helper.

Signed-off-by: Len Baker <len.baker@....com>
---
 arch/arc/kernel/unwind.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
index 47bab67f8649..af18052b86a7 100644
--- a/arch/arc/kernel/unwind.c
+++ b/arch/arc/kernel/unwind.c
@@ -13,6 +13,7 @@
 #include <linux/sched.h>
 #include <linux/module.h>
 #include <linux/memblock.h>
+#include <linux/overflow.h>
 #include <linux/sort.h>
 #include <linux/slab.h>
 #include <linux/stop_machine.h>
@@ -312,9 +313,7 @@ static void init_unwind_hdr(struct unwind_table *table,
 	if (tableSize || !n)
 		goto ret_err;

-	hdrSize = 4 + sizeof(unsigned long) + sizeof(unsigned int)
-	    + 2 * n * sizeof(unsigned long);
-
+	hdrSize = struct_size(header, table, n);
 	header = alloc(hdrSize);
 	if (!header)
 		goto ret_err;
--
2.25.1