Patch "gve: Use size_add() in call to struct_size()" has been added to the 6.6-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    gve: Use size_add() in call to struct_size()

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     gve-use-size_add-in-call-to-struct_size.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d9c4152d008d4b25fbfcee70d7e96931b6c901be
Author: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx>
Date:   Fri Sep 15 12:17:49 2023 -0600

    gve: Use size_add() in call to struct_size()
    
    [ Upstream commit d692873cbe861a870cdc9cbfb120eefd113c3dfd ]
    
    If, for any reason, `tx_stats_num + rx_stats_num` wraps around, the
    protection that struct_size() adds against potential integer overflows
    is defeated. Fix this by hardening call to struct_size() with size_add().
    
    Fixes: 691f4077d560 ("gve: Replace zero-length array with flexible-array member")
    Signed-off-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx>
    Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
index 5704b5f57cd0d..83b09dcfafc4f 100644
--- a/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -190,7 +190,7 @@ static int gve_alloc_stats_report(struct gve_priv *priv)
 	rx_stats_num = (GVE_RX_STATS_REPORT_NUM + NIC_RX_STATS_REPORT_NUM) *
 		       priv->rx_cfg.num_queues;
 	priv->stats_report_len = struct_size(priv->stats_report, stats,
-					     tx_stats_num + rx_stats_num);
+					     size_add(tx_stats_num, rx_stats_num));
 	priv->stats_report =
 		dma_alloc_coherent(&priv->pdev->dev, priv->stats_report_len,
 				   &priv->stats_report_bus, GFP_KERNEL);



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux