linux-kernel - Re: [PATCH] ARC: unwind: Use struct_size helper instead of open-coded arithmetic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e39778bc-4059-49d6-79a1-9a207eb319cf@embeddedor.com>
Date:   Fri, 16 Jul 2021 14:41:42 -0500
From:   "Gustavo A. R. Silva" <gustavo@...eddedor.com>
To:     Len Baker <len.baker@....com>, Vineet Gupta <vgupta@...opsys.com>
Cc:     "dean.yang_cp" <yangdianqing@...ong.com>,
        "Gustavo A. R. Silva" <gustavoars@...nel.org>,
        linux-snps-arc@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ARC: unwind: Use struct_size helper instead of open-coded
 arithmetic



On 7/16/21 12:03, Len Baker wrote:
> Dynamic size calculations (especially multiplication) should not be
> performed in memory allocator function arguments due to the risk of them
> overflowing. This could lead to values wrapping around and a smaller
> allocation being made than the caller was expecting. Using those
> allocations could lead to linear overflows of heap memory and other
> misbehaviors.
> 
> To avoid this scenario, use the struct_size helper.
> 
> Signed-off-by: Len Baker <len.baker@....com>

Reviewed-by: Gustavo A. R. Silva <gustavoars@...nel.org>

Thanks!
--
Gustavo

> ---
>  arch/arc/kernel/unwind.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/arc/kernel/unwind.c b/arch/arc/kernel/unwind.c
> index 47bab67f8649..af18052b86a7 100644
> --- a/arch/arc/kernel/unwind.c
> +++ b/arch/arc/kernel/unwind.c
> @@ -13,6 +13,7 @@
>  #include <linux/sched.h>
>  #include <linux/module.h>
>  #include <linux/memblock.h>
> +#include <linux/overflow.h>
>  #include <linux/sort.h>
>  #include <linux/slab.h>
>  #include <linux/stop_machine.h>
> @@ -312,9 +313,7 @@ static void init_unwind_hdr(struct unwind_table *table,
>  	if (tableSize || !n)
>  		goto ret_err;
> 
> -	hdrSize = 4 + sizeof(unsigned long) + sizeof(unsigned int)
> -	    + 2 * n * sizeof(unsigned long);
> -
> +	hdrSize = struct_size(header, table, n);
>  	header = alloc(hdrSize);
>  	if (!header)
>  		goto ret_err;
> --
> 2.25.1
>