On Thu, 13 May 2021 18:01:55 -0500 "Gustavo A. R. Silva" <gustavoars@xxxxxxxxxx> wrote: > Make use of the struct_size() helper instead of an open-coded version, > in order to avoid any potential type mistakes or integer overflows > that, in the worst scenario, could lead to heap overflows. > > This code was detected with the help of Coccinelle and, audited and > fixed manually. > > Signed-off-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx> > --- > drivers/vfio/vfio_iommu_type1.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c > index a0747c35a778..a3e925a41b0d 100644 > --- a/drivers/vfio/vfio_iommu_type1.c > +++ b/drivers/vfio/vfio_iommu_type1.c > @@ -2795,7 +2795,7 @@ static int vfio_iommu_iova_build_caps(struct vfio_iommu *iommu, > return 0; > } > > - size = sizeof(*cap_iovas) + (iovas * sizeof(*cap_iovas->iova_ranges)); > + size = struct_size(cap_iovas, iova_ranges, iovas); > > cap_iovas = kzalloc(size, GFP_KERNEL); > if (!cap_iovas) Looks good, applied to vfio for-linus branch for v5.13. Thanks, Alex
