As part of the work to perform bounds checking on all memcpy() uses,
replace the open-coded a deserialization of bytes out of memory into a
trailing flexible array by using a flex_array.h helper to perform the
allocation, bounds checking, and copying.
Cc: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>
Cc: Juergen Gross <jgross@xxxxxxxx>
Cc: Stefano Stabellini <sstabellini@xxxxxxxxxx>
Cc: xen-devel@xxxxxxxxxxxxxxxxxxxx
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
---
drivers/xen/xenbus/xenbus_dev_frontend.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 597af455a522..4267aaef33fb 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -81,8 +81,8 @@ struct xenbus_transaction_holder {
struct read_buffer {
struct list_head list;
unsigned int cons;
- unsigned int len;
- char msg[];
+ DECLARE_FLEX_ARRAY_ELEMENTS_COUNT(unsigned int, len);
+ DECLARE_FLEX_ARRAY_ELEMENTS(char, msg);
};
struct xenbus_file_priv {
@@ -188,21 +188,17 @@ static ssize_t xenbus_file_read(struct file *filp,
*/
static int queue_reply(struct list_head *queue, const void *data, size_t len)
{
- struct read_buffer *rb;
+ struct read_buffer *rb = NULL;
if (len == 0)
return 0;
if (len > XENSTORE_PAYLOAD_MAX)
return -EINVAL;
- rb = kmalloc(sizeof(*rb) + len, GFP_KERNEL);
- if (rb == NULL)
+ if (mem_to_flex_dup(&rb, data, len, GFP_KERNEL))
return -ENOMEM;
rb->cons = 0;
- rb->len = len;
-
- memcpy(rb->msg, data, len);
list_add_tail(&rb->list, queue);
return 0;
--
2.32.0
