As part of the work to perform bounds checking on all memcpy() uses,
replace the open-coded a deserialization of bytes out of memory into a
trailing flexible array by using a flex_array.h helper to perform the
allocation, bounds checking, and copying.
Cc: Andy Gross <agross@xxxxxxxxxx>
Cc: Bjorn Andersson <bjorn.andersson@xxxxxxxxxx>
Cc: linux-arm-msm@xxxxxxxxxxxxxxx
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
---
drivers/soc/qcom/apr.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/drivers/soc/qcom/apr.c b/drivers/soc/qcom/apr.c
index 3caabd873322..6cf6f6df276e 100644
--- a/drivers/soc/qcom/apr.c
+++ b/drivers/soc/qcom/apr.c
@@ -40,8 +40,8 @@ struct packet_router {
struct apr_rx_buf {
struct list_head node;
- int len;
- uint8_t buf[];
+ DECLARE_FLEX_ARRAY_ELEMENTS_COUNT(int, len);
+ DECLARE_FLEX_ARRAY_ELEMENTS(uint8_t, buf);
};
/**
@@ -162,7 +162,7 @@ static int apr_callback(struct rpmsg_device *rpdev, void *buf,
int len, void *priv, u32 addr)
{
struct packet_router *apr = dev_get_drvdata(&rpdev->dev);
- struct apr_rx_buf *abuf;
+ struct apr_rx_buf *abuf = NULL;
unsigned long flags;
if (len <= APR_HDR_SIZE) {
@@ -171,13 +171,9 @@ static int apr_callback(struct rpmsg_device *rpdev, void *buf,
return -EINVAL;
}
- abuf = kzalloc(sizeof(*abuf) + len, GFP_ATOMIC);
- if (!abuf)
+ if (mem_to_flex_dup(&abuf, buf, len, GFP_ATOMIC))
return -ENOMEM;
- abuf->len = len;
- memcpy(abuf->buf, buf, len);
-
spin_lock_irqsave(&apr->rx_lock, flags);
list_add_tail(&abuf->node, &apr->rx_list);
spin_unlock_irqrestore(&apr->rx_lock, flags);
--
2.32.0
