Reviewed-by: Lyude Paul <lyude@xxxxxxxxxx> Will push this to drm-misc-next, thanks! On Mon, 2022-02-07 at 17:39 -0600, Gustavo A. R. Silva wrote: > Make use of the struct_size() helper instead of an open-coded version, > in order to avoid any potential type mistakes or integer overflows that, > in the worse scenario, could lead to heap overflows. > > Link: https://github.com/KSPP/linux/issues/160 > Signed-off-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx> > --- > drivers/gpu/drm/nouveau/nouveau_svm.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c > b/drivers/gpu/drm/nouveau/nouveau_svm.c > index 266809e511e2..46a5a1016e37 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_svm.c > +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c > @@ -925,8 +925,8 @@ nouveau_pfns_map(struct nouveau_svmm *svmm, struct > mm_struct *mm, > > mutex_lock(&svmm->mutex); > > - ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) > + > - npages * sizeof(args->p.phys[0]), NULL); > + ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, > + struct_size(args, p.phys, npages), NULL); > > mutex_unlock(&svmm->mutex); > } -- Cheers, Lyude Paul (she/her) Software Engineer at Red Hat
