Patch "virt: acrn: Prefer array_size and struct_size over open coded arithmetic" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    virt: acrn: Prefer array_size and struct_size over open coded arithmetic

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     virt-acrn-prefer-array_size-and-struct_size-over-ope.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 76d495a0377111fd6b88fc3cc4ac4ef94e04ce9c
Author: Len Baker <len.baker@xxxxxxx>
Date:   Fri Oct 29 19:27:46 2021 +0200

    virt: acrn: Prefer array_size and struct_size over open coded arithmetic
    
    [ Upstream commit 746f1b0ac5bf6ecfb71674af210ae476aa714f46 ]
    
    As noted in the "Deprecated Interfaces, Language Features, Attributes,
    and Conventions" documentation [1], size calculations (especially
    multiplication) should not be performed in memory allocator (or similar)
    function arguments due to the risk of them overflowing. This could lead
    to values wrapping around and a smaller allocation being made than the
    caller was expecting. Using those allocations could lead to linear
    overflows of heap memory and other misbehaviors.
    
    So, use the array_size() helper to do the arithmetic instead of the
    argument "count * size" in the vzalloc() function.
    
    Also, take the opportunity to add a flexible array member of struct
    vm_memory_region_op to the vm_memory_region_batch structure. And then,
    change the code accordingly and use the struct_size() helper to do the
    arithmetic instead of the argument "size + size * count" in the kzalloc
    function.
    
    This code was detected with the help of Coccinelle and audited and fixed
    manually.
    
    [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments
    
    Acked-by: Fei Li <fei1.li@xxxxxxxxx>
    Signed-off-by: Len Baker <len.baker@xxxxxxx>
    Signed-off-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx>
    Stable-dep-of: 3d6586008f7b ("drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()")
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/virt/acrn/acrn_drv.h b/drivers/virt/acrn/acrn_drv.h
index 1be54efa666cb..5663c17ad37c7 100644
--- a/drivers/virt/acrn/acrn_drv.h
+++ b/drivers/virt/acrn/acrn_drv.h
@@ -48,6 +48,7 @@ struct vm_memory_region_op {
  * @reserved:		Reserved.
  * @regions_num:	The number of vm_memory_region_op.
  * @regions_gpa:	Physical address of a vm_memory_region_op array.
+ * @regions_op:		Flexible array of vm_memory_region_op.
  *
  * HC_VM_SET_MEMORY_REGIONS uses this structure to manage EPT mappings of
  * multiple memory regions of a User VM. A &struct vm_memory_region_batch
@@ -55,10 +56,11 @@ struct vm_memory_region_op {
  * ACRN Hypervisor.
  */
 struct vm_memory_region_batch {
-	u16	vmid;
-	u16	reserved[3];
-	u32	regions_num;
-	u64	regions_gpa;
+	u16			   vmid;
+	u16			   reserved[3];
+	u32			   regions_num;
+	u64			   regions_gpa;
+	struct vm_memory_region_op regions_op[];
 };
 
 /**
diff --git a/drivers/virt/acrn/mm.c b/drivers/virt/acrn/mm.c
index 3b1b1e7a844b4..b4ad8d452e9a1 100644
--- a/drivers/virt/acrn/mm.c
+++ b/drivers/virt/acrn/mm.c
@@ -192,7 +192,7 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap)
 
 	/* Get the page number of the map region */
 	nr_pages = memmap->len >> PAGE_SHIFT;
-	pages = vzalloc(nr_pages * sizeof(struct page *));
+	pages = vzalloc(array_size(nr_pages, sizeof(*pages)));
 	if (!pages)
 		return -ENOMEM;
 
@@ -244,16 +244,15 @@ int acrn_vm_ram_map(struct acrn_vm *vm, struct acrn_vm_memmap *memmap)
 	}
 
 	/* Prepare the vm_memory_region_batch */
-	regions_info = kzalloc(sizeof(*regions_info) +
-			       sizeof(*vm_region) * nr_regions,
-			       GFP_KERNEL);
+	regions_info = kzalloc(struct_size(regions_info, regions_op,
+					   nr_regions), GFP_KERNEL);
 	if (!regions_info) {
 		ret = -ENOMEM;
 		goto unmap_kernel_map;
 	}
 
 	/* Fill each vm_memory_region_op */
-	vm_region = (struct vm_memory_region_op *)(regions_info + 1);
+	vm_region = regions_info->regions_op;
 	regions_info->vmid = vm->vmid;
 	regions_info->regions_num = nr_regions;
 	regions_info->regions_gpa = virt_to_phys(vm_region);