* [PATCH][next] mlxsw: Use size_mul() in call to struct_size()
@ 2023-09-15 19:01 Gustavo A. R. Silva
2023-09-15 19:42 ` Kees Cook
2023-09-18 7:31 ` Ido Schimmel
0 siblings, 2 replies; 3+ messages in thread
From: Gustavo A. R. Silva @ 2023-09-15 19:01 UTC (permalink / raw)
To: Ido Schimmel, Petr Machata, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Gustavo A. R. Silva
Cc: netdev, linux-kernel, Gustavo A. R. Silva, linux-hardening
If, for any reason, the open-coded arithmetic causes a wraparound, the
protection that `struct_size()` adds against potential integer overflows
is defeated. Fix this by hardening call to `struct_size()` with `size_mul()`.
Fixes: 2285ec872d9d ("mlxsw: spectrum_acl_bloom_filter: use struct_size() in kzalloc()")
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c
index e2aced7ab454..95f63fcf4ba1 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c
@@ -496,7 +496,7 @@ mlxsw_sp_acl_bf_init(struct mlxsw_sp *mlxsw_sp, unsigned int num_erp_banks)
* is 2^ACL_MAX_BF_LOG
*/
bf_bank_size = 1 << MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_BF_LOG);
- bf = kzalloc(struct_size(bf, refcnt, bf_bank_size * num_erp_banks),
+ bf = kzalloc(struct_size(bf, refcnt, size_mul(bf_bank_size, num_erp_banks)),
GFP_KERNEL);
if (!bf)
return ERR_PTR(-ENOMEM);
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH][next] mlxsw: Use size_mul() in call to struct_size()
2023-09-15 19:01 [PATCH][next] mlxsw: Use size_mul() in call to struct_size() Gustavo A. R. Silva
@ 2023-09-15 19:42 ` Kees Cook
2023-09-18 7:31 ` Ido Schimmel
1 sibling, 0 replies; 3+ messages in thread
From: Kees Cook @ 2023-09-15 19:42 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Ido Schimmel, Petr Machata, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Gustavo A. R. Silva, netdev,
linux-kernel, linux-hardening
On Fri, Sep 15, 2023 at 01:01:23PM -0600, Gustavo A. R. Silva wrote:
> If, for any reason, the open-coded arithmetic causes a wraparound, the
> protection that `struct_size()` adds against potential integer overflows
> is defeated. Fix this by hardening call to `struct_size()` with `size_mul()`.
>
> Fixes: 2285ec872d9d ("mlxsw: spectrum_acl_bloom_filter: use struct_size() in kzalloc()")
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
--
Kees Cook
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH][next] mlxsw: Use size_mul() in call to struct_size()
2023-09-15 19:01 [PATCH][next] mlxsw: Use size_mul() in call to struct_size() Gustavo A. R. Silva
2023-09-15 19:42 ` Kees Cook
@ 2023-09-18 7:31 ` Ido Schimmel
1 sibling, 0 replies; 3+ messages in thread
From: Ido Schimmel @ 2023-09-18 7:31 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Ido Schimmel, Petr Machata, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Gustavo A. R. Silva, netdev,
linux-kernel, linux-hardening
On Fri, Sep 15, 2023 at 01:01:23PM -0600, Gustavo A. R. Silva wrote:
> If, for any reason, the open-coded arithmetic causes a wraparound, the
> protection that `struct_size()` adds against potential integer overflows
> is defeated. Fix this by hardening call to `struct_size()` with `size_mul()`.
>
> Fixes: 2285ec872d9d ("mlxsw: spectrum_acl_bloom_filter: use struct_size() in kzalloc()")
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-09-18 7:31 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-09-15 19:01 [PATCH][next] mlxsw: Use size_mul() in call to struct_size() Gustavo A. R. Silva
2023-09-15 19:42 ` Kees Cook
2023-09-18 7:31 ` Ido Schimmel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).