Re: [PATCH] fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 2022-09-01 at 08:18:45 +0300, Dan Carpenter wrote:
> The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit
> systems leading to memory corruption.  Use array_size() to fix that.
> 
> Fixes: 322b598be4d9 ("fpga: dfl: introduce interrupt trigger setting API")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>

Acked-by: Xu Yilun <yilun.xu@xxxxxxxxx>

Applied to fpga for-next.

Thanks
Yilun

> ---
>  drivers/fpga/dfl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c
> index 5498bc337f8b..b9aae85ba930 100644
> --- a/drivers/fpga/dfl.c
> +++ b/drivers/fpga/dfl.c
> @@ -1866,7 +1866,7 @@ long dfl_feature_ioctl_set_irq(struct platform_device *pdev,
>  		return -EINVAL;
>  
>  	fds = memdup_user((void __user *)(arg + sizeof(hdr)),
> -			  hdr.count * sizeof(s32));
> +			  array_size(hdr.count, sizeof(s32)));
>  	if (IS_ERR(fds))
>  		return PTR_ERR(fds);
>  
> -- 
> 2.35.1
> 



[Index of Archives]     [Kernel Development]     [Kernel Announce]     [Kernel Newbies]     [Linux Networking Development]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Device Mapper]

  Powered by Linux