linux-kernel - Re: [PATCH] usb: misc: adutux: replace kmalloc() with kmalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2025052111-able-unfocused-cdcf@gregkh>
Date: Wed, 21 May 2025 12:59:10 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Ethan Carter Edwards <ethan@...ancedwards.com>
Cc: "Gustavo A. R. Silva" <gustavoars@...nel.org>,
	linux-hardening@...r.kernel.org, linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] usb: misc: adutux: replace kmalloc() with kmalloc_array()

On Sat, May 03, 2025 at 04:43:21PM -0400, Ethan Carter Edwards wrote:
> Replace kmalloc with internal multiplication with kmalloc_array to
> improve code readability and prevent potential overflows.

But this is not an array of a structure size.

> 
> Signed-off-by: Ethan Carter Edwards <ethan@...ancedwards.com>
> ---
>  drivers/usb/misc/adutux.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
> index ed6a19254d2ff9fead898adad0b3996822e10167..000a3ade743258f381d85397395a43c28a8481cc 100644
> --- a/drivers/usb/misc/adutux.c
> +++ b/drivers/usb/misc/adutux.c
> @@ -680,7 +680,7 @@ static int adu_probe(struct usb_interface *interface,
>  	in_end_size = usb_endpoint_maxp(dev->interrupt_in_endpoint);
>  	out_end_size = usb_endpoint_maxp(dev->interrupt_out_endpoint);
>  
> -	dev->read_buffer_primary = kmalloc((4 * in_end_size), GFP_KERNEL);
> +	dev->read_buffer_primary = kmalloc_array(4, in_end_size, GFP_KERNEL);

This is a buffer and you need the size to be correct based on the
commands, right?  It's not an array of a structure, but rather a stream
of bytes.


>  	if (!dev->read_buffer_primary)
>  		goto error;
>  
> @@ -690,7 +690,7 @@ static int adu_probe(struct usb_interface *interface,
>  	memset(dev->read_buffer_primary + (2 * in_end_size), 'c', in_end_size);
>  	memset(dev->read_buffer_primary + (3 * in_end_size), 'd', in_end_size);
>  
> -	dev->read_buffer_secondary = kmalloc((4 * in_end_size), GFP_KERNEL);
> +	dev->read_buffer_secondary = kmalloc_array(4, in_end_size, GFP_KERNEL);

Same here.

I think the original code is just fine as there's no bug here or way it
can overflow, right?

thanks,

greg k-h