Re: [RFC PATCH 5/7] firmware: arm_scmi: Add System Telemetry chardev/ioctls API

[Dan Carpenter <dan.carpenter@linaro.org>]

On Fri, Jun 20, 2025 at 08:28:11PM +0100, Cristian Marussi wrote:
> +static long scmi_tlm_des_read_ioctl(struct scmi_tlm_instance *ti,
> +				    unsigned long arg, bool single)
> +{
> +	void * __user uptr = (void * __user)arg;
> +	struct scmi_tlm_setup *tsp = ti->tsp;
> +	struct scmi_tlm_bulk_read bulk, *bulk_ptr;
> +	int ret;
> +
> +	if (copy_from_user(&bulk, uptr, sizeof(bulk)))
> +		return -EFAULT;
> +
> +	bulk_ptr = kzalloc(sizeof(*bulk_ptr) +
> +			     bulk.num_samples * sizeof(bulk_ptr->samples[0]),

This should be struct_size(bulk_ptr, samples, bulk.num_samples) to
avoid an integer overflow on 32bit systems.

regards,
dan carpenter

> +			     GFP_KERNEL);
> +	if (!bulk_ptr)
> +		return -ENOMEM;
> +
> +	bulk_ptr->grp_id = bulk.grp_id;
> +	bulk_ptr->num_samples = bulk.num_samples;
> +	if (!single)
> +		ret = tsp->ops->des_bulk_read(tsp->ph, bulk_ptr->grp_id,
> +					      &bulk_ptr->num_samples,
> +			  (struct scmi_telemetry_de_sample *)bulk_ptr->samples);
> +	else
> +		ret = tsp->ops->des_sample_get(tsp->ph, bulk_ptr->grp_id,
> +					       &bulk_ptr->num_samples,
> +			  (struct scmi_telemetry_de_sample *)bulk_ptr->samples);
> +	if (ret)
> +		goto out;
> +
> +	if (copy_to_user(uptr, bulk_ptr, sizeof(*bulk_ptr) +
> +			 bulk_ptr->num_samples * sizeof(bulk_ptr->samples[0])))
> +		ret = -EFAULT;
> +
> +out:
> +	kfree(bulk_ptr);
> +
> +	return ret;
> +}