tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mlxsw: Use size_mul() in call to struct_size()

If, for any reason, the open-coded arithmetic causes a wraparound, the
protection that `struct_size()` adds against potential integer overflows
is defeated. Fix this by hardening call to `struct_size()` with `size_mul()`.

Fixes: 2285ec872d9d ("mlxsw: spectrum_acl_bloom_filter: use struct_size() in kzalloc()")
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Gustavo A. R. Silva and committed by
David S. Miller e22c6ea0 74fa1a82

+1 -1
+1 -1
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c
··· 496 496 * is 2^ACL_MAX_BF_LOG 497 497 */ 498 498 bf_bank_size = 1 << MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_BF_LOG); 499 - bf = kzalloc(struct_size(bf, refcnt, bf_bank_size * num_erp_banks), 499 + bf = kzalloc(struct_size(bf, refcnt, size_mul(bf_bank_size, num_erp_banks)), 500 500 GFP_KERNEL); 501 501 if (!bf) 502 502 return ERR_PTR(-ENOMEM);