diff options
| author |   Yu Zhe <yuzhe@nfschina.com> | 2022-09-27 15:02:47 +0800 |
|---|---|---|
| committer |   Dan Williams <dan.j.williams@intel.com> | 2022-11-03 11:20:46 -0700 |
| commit | 4f1aa35f1fb7d51b125487c835982af792697ecb (patch) | |
| tree | 2c15f9ba2523e709f8bdfc6325bfb7aa81abf5be | |
| parent | cxl/region: Fix decoder allocation crash (diff) | |
| download | linux-dev-4f1aa35f1fb7d51b125487c835982af792697ecb.tar.xz linux-dev-4f1aa35f1fb7d51b125487c835982af792697ecb.zip | |
cxl/pmem: Use size_add() against integer overflow
"struct_size() + n" may cause a integer overflow,
use size_add() to handle it.
Signed-off-by: Yu Zhe <yuzhe@nfschina.com>
Link: https://lore.kernel.org/r/20220927070247.23148-1-yuzhe@nfschina.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
| -rw-r--r-- | drivers/cxl/pmem.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/cxl/pmem.c b/drivers/cxl/pmem.c index 115a7b79f343..0bac05d804bc 100644 --- a/drivers/cxl/pmem.c +++ b/drivers/cxl/pmem.c @@ -148,7 +148,7 @@ static int cxl_pmem_set_config_data(struct cxl_dev_state *cxlds, return -EINVAL; /* 4-byte status follows the input data in the payload */ - if (struct_size(cmd, in_buf, cmd->in_length) + 4 > buf_len) + if (size_add(struct_size(cmd, in_buf, cmd->in_length), 4) > buf_len) return -EINVAL; set_lsa = |