linux-kernel - Re: [PATCH] mtd: cfi: use struct_size() helper for cfiq allocation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e79d5220-2824-4cd2-8e61-b1da8d22d2a1@ti.com>
Date: Mon, 22 Sep 2025 11:30:08 +0530
From: "Raghavendra, Vignesh" <vigneshr@...com>
To: Gopi Krishna Menon <krishnagopi487@...il.com>, <miquel.raynal@...tlin.com>,
        <richard@....at>
CC: <linux-mtd@...ts.infradead.org>, <linux-kernel@...r.kernel.org>,
        <skhan@...uxfoundation.org>, <david.hunter.linux@...il.com>,
        <linux-kernel-mentees@...ts.linux.dev>
Subject: Re: [PATCH] mtd: cfi: use struct_size() helper for cfiq allocation



On 9/19/2025 12:14 AM, Gopi Krishna Menon wrote:
> Documentation/process/deprecated.rst recommends against performing
> dynamic size calculations in the arguments of memory allocator
> function due to the risk of overflow. Such calculations can
> wrap around and result in a smaller allocation than what the caller
> was expecting.
> 
> Replace the size calculation in cfiq allocation with struct_size()
> helper to make the code clearer and handle the overflows correctly.
> 
> Signed-off-by: Gopi Krishna Menon <krishnagopi487@...il.com>
> ---
>  drivers/mtd/chips/cfi_probe.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mtd/chips/cfi_probe.c b/drivers/mtd/chips/cfi_probe.c
> index a04b6174181c..e254f9cd2796 100644
> --- a/drivers/mtd/chips/cfi_probe.c
> +++ b/drivers/mtd/chips/cfi_probe.c
> @@ -208,7 +208,7 @@ static int __xipram cfi_chip_setup(struct map_info *map,
>  	if (!num_erase_regions)
>  		return 0;
>  
> -	cfi->cfiq = kmalloc(sizeof(struct cfi_ident) + num_erase_regions * 4, GFP_KERNEL);
> +	cfi->cfiq = kmalloc(struct_size(cfi->cfiq, EraseRegionInfo, num_erase_regions), GFP_KERNEL);
>  	if (!cfi->cfiq)
>  		return 0;
> 

Reviewed-by: Vignesh Raghavendra <vigneshr@...com>

There seems to be one more occurrence of this pattern in jedec_probe.c.
Would appreciate if you could fix that too. Thanks!

Regards
Vignesh