All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] KVM: use struct_size() and flex_array_size() helpers in kvm_io_bus_unregister_dev()
@ 2020-09-18 12:05 Rustam Kovhaev
  2020-09-19  0:09 ` Gustavo A. R. Silva
  2020-09-21 12:54 ` Sasha Levin
  0 siblings, 2 replies; 5+ messages in thread
From: Rustam Kovhaev @ 2020-09-18 12:05 UTC (permalink / raw)
  To: pbonzini, vkuznets, gustavoars, kvm
  Cc: linux-kernel, gregkh, stable, Rustam Kovhaev

Make use of the struct_size() helper to avoid any potential type
mistakes and protect against potential integer overflows
Make use of the flex_array_size() helper to calculate the size of a
flexible array member within an enclosing structure

Cc: stable@vger.kernel.org
Suggested-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
---
 virt/kvm/kvm_main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index cf88233b819a..68edd25dcb11 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -4350,10 +4350,10 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
 	new_bus = kmalloc(struct_size(bus, range, bus->dev_count - 1),
 			  GFP_KERNEL_ACCOUNT);
 	if (new_bus) {
-		memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
+		memcpy(new_bus, bus, struct_size(bus, range, i));
 		new_bus->dev_count--;
 		memcpy(new_bus->range + i, bus->range + i + 1,
-		       (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
+				flex_array_size(new_bus, range, new_bus->dev_count - i));
 	} else {
 		pr_err("kvm: failed to shrink bus, removing it completely\n");
 		for (j = 0; j < bus->dev_count; j++) {
-- 
2.28.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-09-30 18:14 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-09-18 12:05 [PATCH] KVM: use struct_size() and flex_array_size() helpers in kvm_io_bus_unregister_dev() Rustam Kovhaev
2020-09-19  0:09 ` Gustavo A. R. Silva
2020-09-22 12:43   ` Paolo Bonzini
2020-09-21 12:54 ` Sasha Levin
2020-09-30 17:58   ` Gustavo A. R. Silva

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.