* [PATCH][next] usb: atm: Use size_add() in call to struct_size()
@ 2023-09-15 19:20 Gustavo A. R. Silva
2023-09-15 19:43 ` Kees Cook
2023-09-29 19:15 ` Kees Cook
0 siblings, 2 replies; 3+ messages in thread
From: Gustavo A. R. Silva @ 2023-09-15 19:20 UTC (permalink / raw)
To: Duncan Sands, Greg Kroah-Hartman, Gustavo A. R. Silva
Cc: linux-usb, linux-kernel, Gustavo A. R. Silva, linux-hardening
If, for any reason, the open-coded arithmetic causes a wraparound,
the protection that `struct_size()` adds against potential integer
overflows is defeated. Fix this by hardening call to `struct_size()`
with `size_add()`.
Fixes: b626871a7cda ("usb: atm: Use struct_size() helper")
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
drivers/usb/atm/usbatm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
index 1cdb8758ae01..2da6615fbb6f 100644
--- a/drivers/usb/atm/usbatm.c
+++ b/drivers/usb/atm/usbatm.c
@@ -1018,7 +1018,8 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
size_t size;
/* instance init */
- size = struct_size(instance, urbs, num_rcv_urbs + num_snd_urbs);
+ size = struct_size(instance, urbs,
+ size_add(num_rcv_urbs, num_snd_urbs));
instance = kzalloc(size, GFP_KERNEL);
if (!instance)
return -ENOMEM;
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH][next] usb: atm: Use size_add() in call to struct_size()
2023-09-15 19:20 [PATCH][next] usb: atm: Use size_add() in call to struct_size() Gustavo A. R. Silva
@ 2023-09-15 19:43 ` Kees Cook
2023-09-29 19:15 ` Kees Cook
1 sibling, 0 replies; 3+ messages in thread
From: Kees Cook @ 2023-09-15 19:43 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Duncan Sands, Greg Kroah-Hartman, linux-usb, linux-kernel,
linux-hardening
On Fri, Sep 15, 2023 at 01:20:14PM -0600, Gustavo A. R. Silva wrote:
> If, for any reason, the open-coded arithmetic causes a wraparound,
> the protection that `struct_size()` adds against potential integer
> overflows is defeated. Fix this by hardening call to `struct_size()`
> with `size_add()`.
>
> Fixes: b626871a7cda ("usb: atm: Use struct_size() helper")
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
--
Kees Cook
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH][next] usb: atm: Use size_add() in call to struct_size()
2023-09-15 19:20 [PATCH][next] usb: atm: Use size_add() in call to struct_size() Gustavo A. R. Silva
2023-09-15 19:43 ` Kees Cook
@ 2023-09-29 19:15 ` Kees Cook
1 sibling, 0 replies; 3+ messages in thread
From: Kees Cook @ 2023-09-29 19:15 UTC (permalink / raw)
To: Duncan Sands, Greg Kroah-Hartman, Gustavo A. R. Silva
Cc: Kees Cook, linux-usb, linux-kernel, linux-hardening
On Fri, 15 Sep 2023 13:20:14 -0600, Gustavo A. R. Silva wrote:
> If, for any reason, the open-coded arithmetic causes a wraparound,
> the protection that `struct_size()` adds against potential integer
> overflows is defeated. Fix this by hardening call to `struct_size()`
> with `size_add()`.
>
>
Applied to for-next/hardening, thanks!
[1/1] usb: atm: Use size_add() in call to struct_size()
https://git.kernel.org/kees/c/13f1a60fe04f
Take care,
--
Kees Cook
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-09-29 19:15 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-09-15 19:20 [PATCH][next] usb: atm: Use size_add() in call to struct_size() Gustavo A. R. Silva
2023-09-15 19:43 ` Kees Cook
2023-09-29 19:15 ` Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox