Patch "net/ipv4: Revert use of struct_size() helper" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net/ipv4: Revert use of struct_size() helper

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-ipv4-revert-use-of-struct_size-helper.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2374687a2fd9982fe6edc38927565b7e97f1d03a
Author: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx>
Date:   Wed Aug 4 13:23:25 2021 -0500

    net/ipv4: Revert use of struct_size() helper
    
    [ Upstream commit 4167a960574fcadc9067f4280951a35b8c021c68 ]
    
    Revert the use of structr_size() and stay with IP_MSFILTER_SIZE() for
    now, as in this case, the size of struct ip_msfilter didn't change with
    the addition of the flexible array imsf_slist_flex[]. So, if we use
    struct_size() we will be allocating and calculating the size of
    struct ip_msfilter with one too many items for imsf_slist_flex[].
    
    We might use struct_size() in the future, but for now let's stay
    with IP_MSFILTER_SIZE().
    
    Fixes: 2d3e5caf96b9 ("net/ipv4: Replace one-element array with flexible-array member")
    Signed-off-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Stable-dep-of: 5c3be3e0eb44 ("ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function")
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 134f1682a7e9b..4ba1c92fb3524 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -2573,8 +2573,8 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
 	copycount = count < msf->imsf_numsrc ? count : msf->imsf_numsrc;
 	len = flex_array_size(psl, sl_addr, copycount);
 	msf->imsf_numsrc = count;
-	if (put_user(struct_size(optval, imsf_slist_flex, copycount), optlen) ||
-	    copy_to_user(optval, msf, struct_size(optval, imsf_slist_flex, 0))) {
+	if (put_user(IP_MSFILTER_SIZE(copycount), optlen) ||
+	    copy_to_user(optval, msf, IP_MSFILTER_SIZE(0))) {
 		return -EFAULT;
 	}
 	if (len &&
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 2cfc507712300..28b9b2e85f0be 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -674,7 +674,7 @@ static int set_mcast_msfilter(struct sock *sk, int ifindex,
 	struct sockaddr_in *psin;
 	int err, i;
 
-	msf = kmalloc(struct_size(msf, imsf_slist_flex, numsrc), GFP_KERNEL);
+	msf = kmalloc(IP_MSFILTER_SIZE(numsrc), GFP_KERNEL);
 	if (!msf)
 		return -ENOBUFS;
 
@@ -1235,7 +1235,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, int optname,
 	{
 		struct ip_msfilter *msf;
 
-		if (optlen < struct_size(msf, imsf_slist_flex, 0))
+		if (optlen < IP_MSFILTER_SIZE(0))
 			goto e_inval;
 		if (optlen > READ_ONCE(sysctl_optmem_max)) {
 			err = -ENOBUFS;
@@ -1253,8 +1253,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, int optname,
 			err = -ENOBUFS;
 			break;
 		}
-		if (struct_size(msf, imsf_slist_flex, msf->imsf_numsrc) >
-		    optlen) {
+		if (IP_MSFILTER_SIZE(msf->imsf_numsrc) > optlen) {
 			kfree(msf);
 			err = -EINVAL;
 			break;
@@ -1667,12 +1666,11 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
 	{
 		struct ip_msfilter msf;
 
-		if (len < struct_size(&msf, imsf_slist_flex, 0)) {
+		if (len < IP_MSFILTER_SIZE(0)) {
 			err = -EINVAL;
 			goto out;
 		}
-		if (copy_from_user(&msf, optval,
-				   struct_size(&msf, imsf_slist_flex, 0))) {
+		if (copy_from_user(&msf, optval, IP_MSFILTER_SIZE(0))) {
 			err = -EFAULT;
 			goto out;
 		}