From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B136C433EF for ; Tue, 8 Feb 2022 22:24:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239759AbiBHWYg (ORCPT ); Tue, 8 Feb 2022 17:24:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49316 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1386330AbiBHUJX (ORCPT ); Tue, 8 Feb 2022 15:09:23 -0500 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 667F3C0612C0 for ; Tue, 8 Feb 2022 12:09:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1644350962; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=I3/8UwtTiLaHjDIsw5ToTGGU9VaJhcJtecxqfQCO+Kg=; b=T9LIjWSY8erc6swS5RMD3ac4dSW9AURKcftZzyOXsyqGJmKjzzPqkh90HhjVcM7hENPOZA o7U+e5K8KuV5/7OvHPXE6OfoIiUgeNG+gKJ4MXyzAOZfsgndgERkUxBXZZ2BZLb3jMm2JR rDsULcP42tEt8g/breLSYGzSF5tWTAI= Received: from mail-qk1-f199.google.com (mail-qk1-f199.google.com [209.85.222.199]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-85-oKUkQaniOh-nlozL2ejzCw-1; Tue, 08 Feb 2022 15:09:17 -0500 X-MC-Unique: oKUkQaniOh-nlozL2ejzCw-1 Received: by mail-qk1-f199.google.com with SMTP id b204-20020a3767d5000000b004b2a0d2e930so11754304qkc.15 for ; Tue, 08 Feb 2022 12:09:17 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:subject:from:to:cc:date:in-reply-to :references:organization:user-agent:mime-version :content-transfer-encoding; bh=I3/8UwtTiLaHjDIsw5ToTGGU9VaJhcJtecxqfQCO+Kg=; b=HSgNsMYUuWk9UqXBg0Zy8FxaSHE/YawbHiJQualLomMDHA67Z7c5gWww+x/oPC0ISl KlWn/wzo/rcHzH5/IIgxDyL8jD7ZYNGsIVREu7EQAaxyPUESgUFZyYXumDOOyna83OCS EtuGEA57WD+TQayFNl+HE5uF2CHRjzYKYmh6LoQx5BEqJy8h9tUkms0B95I2UUAMOnU3 Bre4Yj38p5ov+J72zZdlAeUCUUAAG79wJkSS3B5dZXZJO5JRHgYdFstRFF+K+zvl0kyj zBL8lBzmAkzCcK+1jNvaNEjNPPKURlVzbxP2vQYUkpYwPo65JAjPmxObc5P0N3eppfuM zYDg== X-Gm-Message-State: AOAM530JlV2TXqlKRE3bdT/kX9fC9xOSF4j3MPX7H65HyRxrv8dTVp00 vpGxkix05yYu268AYTx4WPbL5eQGkDHJoCrDBxACWu9bGRmmmFz3YePx5P7x1ewtMwc9He4YtDK zogU6wg6x6nQjVnbHSfqh4P7mL9Xu X-Received: by 2002:a05:6214:4111:: with SMTP id kc17mr4417588qvb.61.1644350957410; Tue, 08 Feb 2022 12:09:17 -0800 (PST) X-Google-Smtp-Source: ABdhPJxsREE/wlVXhB/X8tBjZ+cErEBHMvIYU1EUljfRg7HUFF85vJYIMBgalTBx0/F2MZWG8LFj8g== X-Received: by 2002:a05:6214:4111:: with SMTP id kc17mr4417571qvb.61.1644350957203; Tue, 08 Feb 2022 12:09:17 -0800 (PST) Received: from [192.168.8.138] (pool-96-230-100-15.bstnma.fios.verizon.net. [96.230.100.15]) by smtp.gmail.com with ESMTPSA id p70sm7253061qka.62.2022.02.08.12.09.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 08 Feb 2022 12:09:16 -0800 (PST) Message-ID: <58cc03e21bdf8665f402c7eb9beed557f19a4be2.camel@redhat.com> Subject: Re: [PATCH][next] nouveau/svm: Use struct_size() helper in nouveau_pfns_map() From: Lyude Paul To: "Gustavo A. R. Silva" , Ben Skeggs , Karol Herbst , David Airlie , Daniel Vetter Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Date: Tue, 08 Feb 2022 15:09:04 -0500 In-Reply-To: <20220207233923.GA524723@embeddedor> References: <20220207233923.GA524723@embeddedor> Organization: Red Hat Inc. User-Agent: Evolution 3.42.3 (3.42.3-1.fc35) MIME-Version: 1.0 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=lyude@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Reviewed-by: Lyude Paul Will push this to drm-misc-next, thanks! On Mon, 2022-02-07 at 17:39 -0600, Gustavo A. R. Silva wrote: > Make use of the struct_size() helper instead of an open-coded version, > in order to avoid any potential type mistakes or integer overflows that, > in the worse scenario, could lead to heap overflows. > > Link: https://github.com/KSPP/linux/issues/160 > Signed-off-by: Gustavo A. R. Silva > --- >  drivers/gpu/drm/nouveau/nouveau_svm.c | 4 ++-- >  1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c > b/drivers/gpu/drm/nouveau/nouveau_svm.c > index 266809e511e2..46a5a1016e37 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_svm.c > +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c > @@ -925,8 +925,8 @@ nouveau_pfns_map(struct nouveau_svmm *svmm, struct > mm_struct *mm, >   >         mutex_lock(&svmm->mutex); >   > -       ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) > + > -                               npages * sizeof(args->p.phys[0]), NULL); > +       ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, > +                               struct_size(args, p.phys, npages), NULL); >   >         mutex_unlock(&svmm->mutex); >  } -- Cheers, Lyude Paul (she/her) Software Engineer at Red Hat From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7D073C433F5 for ; Tue, 8 Feb 2022 20:09:24 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id B605710E125; Tue, 8 Feb 2022 20:09:23 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by gabe.freedesktop.org (Postfix) with ESMTPS id A1AB910E125 for ; Tue, 8 Feb 2022 20:09:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1644350961; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=I3/8UwtTiLaHjDIsw5ToTGGU9VaJhcJtecxqfQCO+Kg=; b=E1dQBbkrtUDbVwISoUl0RLNImuuiSrzaSnxvSn3I3awcmPwNPyg3S2hwTbaPsl1h5W9qc5 85eOds5djgpWZrUMek338uxDyNImSzYVPKMw6EY1+j23+leiosSENPjj3bLFh+6TBEmMC0 XqvpZm2cWyuuiLjfRr6YjJLkwCCpMXY= Received: from mail-qk1-f198.google.com (mail-qk1-f198.google.com [209.85.222.198]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-280-FCpLPGtIOpurzQnOCADEoQ-1; Tue, 08 Feb 2022 15:09:17 -0500 X-MC-Unique: FCpLPGtIOpurzQnOCADEoQ-1 Received: by mail-qk1-f198.google.com with SMTP id z205-20020a3765d6000000b0047db3b020dfso11722753qkb.22 for ; Tue, 08 Feb 2022 12:09:17 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:subject:from:to:cc:date:in-reply-to :references:organization:user-agent:mime-version :content-transfer-encoding; bh=I3/8UwtTiLaHjDIsw5ToTGGU9VaJhcJtecxqfQCO+Kg=; b=PiFtErJXF0uSzIefv+2jnxlD87EsKcYHyxAY+Nsew5cXNN0VGB72wO2MhZPsRGR+l2 UvgjCytWaLr79SghDQJfP7omILYfkKHxiB26pjMKtQrpHqj3wQW2/l/mNSScfleLr/FY vOVAC7Hra/vLK3Tut5IYq+NFLtERbHzEsq2PwzBJChp1plKUJTzZgwws8ekT5oZFp32w R5ihA+K9zMJ5r1ZfQ5BU3Acqen8PGNFQ5WkWXsIuEPiFqz0sKC0qceyU2F4zblqgtEMX iXXq+Taa4cS5kGKIdigQWzmlmlFdxU0A4oEwIWZizPOf6UYGAsQG6Lno7yXc/fi7SrXI mgBA== X-Gm-Message-State: AOAM532ooXXzQsruUpqPGy3qoHQ8IbU13jZxV6Ti/MRsLoG019B8w/e2 f/5uhvBsj7V33v9dQ3+7uKcqiEbkh0m99OprOfVuJeEl274qkjJ+IYuV8vDAtmiAxbk9mjU2MMr IpIWAEqO6JzVqFouCQqBsI0YHJQ== X-Received: by 2002:a05:6214:4111:: with SMTP id kc17mr4417585qvb.61.1644350957408; Tue, 08 Feb 2022 12:09:17 -0800 (PST) X-Google-Smtp-Source: ABdhPJxsREE/wlVXhB/X8tBjZ+cErEBHMvIYU1EUljfRg7HUFF85vJYIMBgalTBx0/F2MZWG8LFj8g== X-Received: by 2002:a05:6214:4111:: with SMTP id kc17mr4417571qvb.61.1644350957203; Tue, 08 Feb 2022 12:09:17 -0800 (PST) Received: from [192.168.8.138] (pool-96-230-100-15.bstnma.fios.verizon.net. [96.230.100.15]) by smtp.gmail.com with ESMTPSA id p70sm7253061qka.62.2022.02.08.12.09.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 08 Feb 2022 12:09:16 -0800 (PST) Message-ID: <58cc03e21bdf8665f402c7eb9beed557f19a4be2.camel@redhat.com> From: Lyude Paul To: "Gustavo A. R. Silva" , Ben Skeggs , Karol Herbst , David Airlie , Daniel Vetter Date: Tue, 08 Feb 2022 15:09:04 -0500 In-Reply-To: <20220207233923.GA524723@embeddedor> References: <20220207233923.GA524723@embeddedor> Organization: Red Hat Inc. User-Agent: Evolution 3.42.3 (3.42.3-1.fc35) MIME-Version: 1.0 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=lyude@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit Subject: Re: [Nouveau] [PATCH][next] nouveau/svm: Use struct_size() helper in nouveau_pfns_map() X-BeenThere: nouveau@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Nouveau development list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-hardening@vger.kernel.org Errors-To: nouveau-bounces@lists.freedesktop.org Sender: "Nouveau" Reviewed-by: Lyude Paul Will push this to drm-misc-next, thanks! On Mon, 2022-02-07 at 17:39 -0600, Gustavo A. R. Silva wrote: > Make use of the struct_size() helper instead of an open-coded version, > in order to avoid any potential type mistakes or integer overflows that, > in the worse scenario, could lead to heap overflows. > > Link: https://github.com/KSPP/linux/issues/160 > Signed-off-by: Gustavo A. R. Silva > --- >  drivers/gpu/drm/nouveau/nouveau_svm.c | 4 ++-- >  1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c > b/drivers/gpu/drm/nouveau/nouveau_svm.c > index 266809e511e2..46a5a1016e37 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_svm.c > +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c > @@ -925,8 +925,8 @@ nouveau_pfns_map(struct nouveau_svmm *svmm, struct > mm_struct *mm, >   >         mutex_lock(&svmm->mutex); >   > -       ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) > + > -                               npages * sizeof(args->p.phys[0]), NULL); > +       ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, > +                               struct_size(args, p.phys, npages), NULL); >   >         mutex_unlock(&svmm->mutex); >  } -- Cheers, Lyude Paul (she/her) Software Engineer at Red Hat From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 6810FC433F5 for ; Tue, 8 Feb 2022 20:09:28 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 741F410E15D; Tue, 8 Feb 2022 20:09:27 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by gabe.freedesktop.org (Postfix) with ESMTPS id D969110E15D for ; Tue, 8 Feb 2022 20:09:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1644350965; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=I3/8UwtTiLaHjDIsw5ToTGGU9VaJhcJtecxqfQCO+Kg=; b=g8nU53UAHC5QB2KVi18fdbaLfZ1t3lAi8wL+tHFlqMS85UQ2WGf7a7ZAgg10mnjFyzQizT e3sB5mSH8Gpopj1rhl6qtTXjOLgtOYrX1Stjdpe3LK/ZwkV+aeQOhvvMl8/kSTmr8DSC+i 9nRqJbNY0SIjClW3/6j5uGUbr+2xhCs= Received: from mail-qk1-f197.google.com (mail-qk1-f197.google.com [209.85.222.197]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-99-Il41676ONt2p3xsjbgWr-A-1; Tue, 08 Feb 2022 15:09:17 -0500 X-MC-Unique: Il41676ONt2p3xsjbgWr-A-1 Received: by mail-qk1-f197.google.com with SMTP id bl5-20020a05620a1a8500b005088d061be4so6250527qkb.21 for ; Tue, 08 Feb 2022 12:09:17 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:subject:from:to:cc:date:in-reply-to :references:organization:user-agent:mime-version :content-transfer-encoding; bh=I3/8UwtTiLaHjDIsw5ToTGGU9VaJhcJtecxqfQCO+Kg=; b=kO1uomKDoZKq5+0l7j+J2fpGosWySqzVpPYinEssGP2BsNg1qkzoQznq1JOt60gdkI dxgCqkS5DA1uX/gHM9KBHFTMF7gZW0TYB1DQG3RTlfe4OJoWVKD+yZtf7V63MNIupq4X GmWFJSj74caVYEw+Ns2gJTmOBaqBwicDVqzAy3HLd9A3kOf6lEj8xNiuoDUtp74+RxoC bTnZatu3Cdmb81mCn+W7QZRGGBqRF59h+ErV2QtB3jJVkHNATuOjkm8vBJaclwFA5NEb NEh6hxadn/r33IDnUYTVFRrGXzYokSbZiJvNqY5h1FPycf8PhTHwp3TIG6BF7221dQsR Vtxg== X-Gm-Message-State: AOAM531y4LEvdt8L99VZF4WFe6bVoTPUjBSY/qJs7J5f9TEhCYGbANsu WT1WC8m9hgVnaVLB5BZTSY0PG5S15/4yNH+TSOeXzwZz8evHkU8usrVybzWZA90hHXG7RXVD5Hi R8uqbx3x/eS6cgnt+4XCYwElxGZfr X-Received: by 2002:a05:6214:4111:: with SMTP id kc17mr4417590qvb.61.1644350957410; Tue, 08 Feb 2022 12:09:17 -0800 (PST) X-Google-Smtp-Source: ABdhPJxsREE/wlVXhB/X8tBjZ+cErEBHMvIYU1EUljfRg7HUFF85vJYIMBgalTBx0/F2MZWG8LFj8g== X-Received: by 2002:a05:6214:4111:: with SMTP id kc17mr4417571qvb.61.1644350957203; Tue, 08 Feb 2022 12:09:17 -0800 (PST) Received: from [192.168.8.138] (pool-96-230-100-15.bstnma.fios.verizon.net. [96.230.100.15]) by smtp.gmail.com with ESMTPSA id p70sm7253061qka.62.2022.02.08.12.09.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 08 Feb 2022 12:09:16 -0800 (PST) Message-ID: <58cc03e21bdf8665f402c7eb9beed557f19a4be2.camel@redhat.com> Subject: Re: [PATCH][next] nouveau/svm: Use struct_size() helper in nouveau_pfns_map() From: Lyude Paul To: "Gustavo A. R. Silva" , Ben Skeggs , Karol Herbst , David Airlie , Daniel Vetter Date: Tue, 08 Feb 2022 15:09:04 -0500 In-Reply-To: <20220207233923.GA524723@embeddedor> References: <20220207233923.GA524723@embeddedor> Organization: Red Hat Inc. User-Agent: Evolution 3.42.3 (3.42.3-1.fc35) MIME-Version: 1.0 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=lyude@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-hardening@vger.kernel.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Reviewed-by: Lyude Paul Will push this to drm-misc-next, thanks! On Mon, 2022-02-07 at 17:39 -0600, Gustavo A. R. Silva wrote: > Make use of the struct_size() helper instead of an open-coded version, > in order to avoid any potential type mistakes or integer overflows that, > in the worse scenario, could lead to heap overflows. > > Link: https://github.com/KSPP/linux/issues/160 > Signed-off-by: Gustavo A. R. Silva > --- >  drivers/gpu/drm/nouveau/nouveau_svm.c | 4 ++-- >  1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c > b/drivers/gpu/drm/nouveau/nouveau_svm.c > index 266809e511e2..46a5a1016e37 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_svm.c > +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c > @@ -925,8 +925,8 @@ nouveau_pfns_map(struct nouveau_svmm *svmm, struct > mm_struct *mm, >   >         mutex_lock(&svmm->mutex); >   > -       ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) > + > -                               npages * sizeof(args->p.phys[0]), NULL); > +       ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, > +                               struct_size(args, p.phys, npages), NULL); >   >         mutex_unlock(&svmm->mutex); >  } -- Cheers, Lyude Paul (she/her) Software Engineer at Red Hat