tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

gve: Use size_add() in call to struct_size()

If, for any reason, `tx_stats_num + rx_stats_num` wraps around, the
protection that struct_size() adds against potential integer overflows
is defeated. Fix this by hardening call to struct_size() with size_add().

Fixes: 691f4077d560 ("gve: Replace zero-length array with flexible-array member")
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Gustavo A. R. Silva and committed by
David S. Miller d692873c ebdada9d

+1 -1
+1 -1
drivers/net/ethernet/google/gve/gve_main.c
··· 190 190 rx_stats_num = (GVE_RX_STATS_REPORT_NUM + NIC_RX_STATS_REPORT_NUM) * 191 191 priv->rx_cfg.num_queues; 192 192 priv->stats_report_len = struct_size(priv->stats_report, stats, 193 - tx_stats_num + rx_stats_num); 193 + size_add(tx_stats_num, rx_stats_num)); 194 194 priv->stats_report = 195 195 dma_alloc_coherent(&priv->pdev->dev, priv->stats_report_len, 196 196 &priv->stats_report_bus, GFP_KERNEL);