Gustavo A. R. Silva
2022-Feb-07 23:39 UTC
[Nouveau] [PATCH][next] nouveau/svm: Use struct_size() helper in nouveau_pfns_map()
Make use of the struct_size() helper instead of an open-coded version, in order to avoid any potential type mistakes or integer overflows that, in the worse scenario, could lead to heap overflows. Link: https://github.com/KSPP/linux/issues/160 Signed-off-by: Gustavo A. R. Silva <gustavoars at kernel.org> --- drivers/gpu/drm/nouveau/nouveau_svm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c index 266809e511e2..46a5a1016e37 100644 --- a/drivers/gpu/drm/nouveau/nouveau_svm.c +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c @@ -925,8 +925,8 @@ nouveau_pfns_map(struct nouveau_svmm *svmm, struct mm_struct *mm, mutex_lock(&svmm->mutex); - ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) + - npages * sizeof(args->p.phys[0]), NULL); + ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, + struct_size(args, p.phys, npages), NULL); mutex_unlock(&svmm->mutex); } -- 2.27.0
Lyude Paul
2022-Feb-08 20:09 UTC
[Nouveau] [PATCH][next] nouveau/svm: Use struct_size() helper in nouveau_pfns_map()
Reviewed-by: Lyude Paul <lyude at redhat.com> Will push this to drm-misc-next, thanks! On Mon, 2022-02-07 at 17:39 -0600, Gustavo A. R. Silva wrote:> Make use of the struct_size() helper instead of an open-coded version, > in order to avoid any potential type mistakes or integer overflows that, > in the worse scenario, could lead to heap overflows. > > Link: https://github.com/KSPP/linux/issues/160 > Signed-off-by: Gustavo A. R. Silva <gustavoars at kernel.org> > --- > ?drivers/gpu/drm/nouveau/nouveau_svm.c | 4 ++-- > ?1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c > b/drivers/gpu/drm/nouveau/nouveau_svm.c > index 266809e511e2..46a5a1016e37 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_svm.c > +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c > @@ -925,8 +925,8 @@ nouveau_pfns_map(struct nouveau_svmm *svmm, struct > mm_struct *mm, > ? > ????????mutex_lock(&svmm->mutex); > ? > -???????ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) > + > -???????????????????????????????npages * sizeof(args->p.phys[0]), NULL); > +???????ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, > +???????????????????????????????struct_size(args, p.phys, npages), NULL); > ? > ????????mutex_unlock(&svmm->mutex); > ?}-- Cheers, Lyude Paul (she/her) Software Engineer at Red Hat