On Thu, Jun 7, 2018 at 12:29 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote: > On Thu, Jun 7, 2018 at 7:57 AM, Matthew Wilcox <willy@xxxxxxxxxxxxx> wrote: >> From: Matthew Wilcox <mawilcox@xxxxxxxxxxxxx> >> >> Signed-off-by: Matthew Wilcox <mawilcox@xxxxxxxxxxxxx> >> --- >> drivers/char/virtio_console.c | 3 +-- >> 1 file changed, 1 insertion(+), 2 deletions(-) >> >> diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c >> index 21085515814f..4bf7c06c2343 100644 >> --- a/drivers/char/virtio_console.c >> +++ b/drivers/char/virtio_console.c >> @@ -433,8 +433,7 @@ static struct port_buffer *alloc_buf(struct virtio_device *vdev, size_t buf_size >> * Allocate buffer and the sg list. The sg list array is allocated >> * directly after the port_buffer struct. >> */ >> - buf = kmalloc(sizeof(*buf) + sizeof(struct scatterlist) * pages, >> - GFP_KERNEL); >> + buf = kmalloc(struct_size(buf, sg, pages), GFP_KERNEL); >> if (!buf) >> goto fail; > > I feel like this one should have been caught by Coccinelle... maybe > the transitive case got missed? Regardless, I'll figure out how to > improve the script and/or take these. Oh, duh. Got it: "struct scatterlist" is not an expression, it's a type. I'll adjust the script, catch stragglers, and incorporate your patches. :) Thanks! -Kees -- Kees Cook Pixel Security
