mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-30 14:19:16 +00:00
Code Issues Releases Wiki Activity

nl80211: prefer struct_size over open coded arithmetic

Browse source 
As noted in the "Deprecated Interfaces, Language Features, Attributes,
and Conventions" documentation [1], size calculations (especially
multiplication) should not be performed in memory allocator (or similar)
function arguments due to the risk of them overflowing. This could lead
to values wrapping around and a smaller allocation being made than the
caller was expecting. Using those allocations could lead to linear
overflows of heap memory and other misbehaviors.

So, use the struct_size() helper to do the arithmetic instead of the
argument "size + count * size" in the kzalloc() functions.

Also, take the opportunity to refactor the memcpy() call to use the
flex_array_size() helper.

[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments

Signed-off-by: Len Baker <len.baker@gmx.com>
Link: https://lore.kernel.org/r/20210919114040.41522-1-len.baker@gmx.com
[remove unnecessary variable]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Len Baker 2021-09-19 13:40:40 +02:00 committed by Johannes Berg
parent 68ba1131d4
commit 40f231e75a
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
net/wireless/nl80211.c
View file

@ -11767,8 +11767,9 @@ static int nl80211_set_cqm_rssi(struct genl_info *info,
if (n_thresholds) {
struct cfg80211_cqm_config *cqm_config;
cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
n_thresholds * sizeof(s32), GFP_KERNEL);
cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
n_thresholds),
GFP_KERNEL);
if (!cqm_config) {
err = -ENOMEM;
goto unlock;
@ -11777,7 +11778,8 @@ static int nl80211_set_cqm_rssi(struct genl_info *info,
cqm_config->rssi_hyst = hysteresis;
cqm_config->n_rssi_thresholds = n_thresholds;
memcpy(cqm_config->rssi_thresholds, thresholds,
n_thresholds * sizeof(s32));
flex_array_size(cqm_config, rssi_thresholds,
n_thresholds));
wdev->cqm_config = cqm_config;
}
@ -15081,9 +15083,7 @@ static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
return -EINVAL;
sar_spec = kzalloc(sizeof(*sar_spec) +
specs * sizeof(struct cfg80211_sar_sub_specs),
GFP_KERNEL);
sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
if (!sar_spec)
return -ENOMEM;