diff options
| author |   Gustavo A. R. Silva <gustavoars@kernel.org> | 2021-09-27 17:53:33 -0500 |
|---|---|---|
| committer |   Jason Gunthorpe <jgg@nvidia.com> | 2021-09-27 20:15:54 -0300 |
| commit | 11333be19c08b9277a87eb8c163217b8c362e91e (patch) | |
| tree | c60c0ba3c1369fea82e5b5ecc63671b06a1b4822 | |
| parent | IB/hfi1: Add ring consumer and producers traces (diff) | |
| download | linux-dev-11333be19c08b9277a87eb8c163217b8c362e91e.tar.xz linux-dev-11333be19c08b9277a87eb8c163217b8c362e91e.zip | |
RDMA/hfi1: Use struct_size() and flex_array_size() helpers
Make use of the struct_size() and flex_array_size() helpers instead of
open-coded versions, in order to avoid any potential type mistakes or
integer overflows that, in the worse scenario, could lead to heap
overflows.
Link: https://lore.kernel.org/r/20210927225333.GA192634@embeddedor
Link: https://github.com/KSPP/linux/issues/160
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
| -rw-r--r-- | drivers/infiniband/hw/hfi1/user_exp_rcv.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c index 0c86e9d354f8..186d30291260 100644 --- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c +++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c @@ -692,8 +692,7 @@ static int set_rcvarray_entry(struct hfi1_filedata *fd, * Allocate the node first so we can handle a potential * failure before we've programmed anything. */ - node = kzalloc(sizeof(*node) + (sizeof(struct page *) * npages), - GFP_KERNEL); + node = kzalloc(struct_size(node, pages, npages), GFP_KERNEL); if (!node) return -ENOMEM; @@ -713,7 +712,7 @@ static int set_rcvarray_entry(struct hfi1_filedata *fd, node->dma_addr = phys; node->grp = grp; node->freed = false; - memcpy(node->pages, pages, sizeof(struct page *) * npages); + memcpy(node->pages, pages, flex_array_size(node, pages, npages)); if (fd->use_mn) { ret = mmu_interval_notifier_insert( |