net: spider_net: Use size_add() in call to struct_size()
Subsystems (2)
PATCH 1/1 net: spider_net: Use size_add() in call to struct_size()
If, for any reason, the open-coded arithmetic causes a wraparound, the protection that struct_size() adds against potential integer overflows is defeated. Fix this by hardening call to struct_size() with size_add().
--- drivers/net/ethernet/toshiba/spider_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/toshiba/spider_net.c +1 -1
@@ -2332,7 +2332,7 @@ spider_net_alloc_card(void)struct spider_net_card *card; netdev =alloc_etherdev (struct_size (card, darray, - tx_descriptors + rx_descriptors)); +size_add (tx_descriptors, rx_descriptors)));if (!netdev)return NULL ;
Signature · 1 line
2.34.1
Quoted 7 lines · Gustavo A. R. Silva
If, for any reason, the open-coded arithmetic causes a wraparound, the protection that
struct_size()adds against potential integer overflows is defeated. Fix this by hardening call tostruct_size()withsize_add().Fixes 3f1071ec39f7 ("net: spider_net: Use struct_size() helper")Signed-off-by Gustavo A. R. Silva <[email protected]>
Signature · 1 line
Kees Cook
Quoted 16 lines · Gustavo A. R. Silva
If, for any reason, the open-coded arithmetic causes a wraparound, the protection that
struct_size()adds against potential integer overflows is defeated. Fix this by hardening call tostruct_size()withsize_add().Fixes 3f1071ec39f7 ("net: spider_net: Use struct_size() helper")Signed-off-by Gustavo A. R. Silva <[email protected]>--- drivers/net/ethernet/toshiba/spider_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/net/ethernet/toshiba/spider_net.c +0
-0
drivers/net/ethernet/toshiba/spider_net.c spider_net_alloc_card(void) · line 2338
Quoted 8 lines
drivers/net/ethernet/toshiba/spider_net.c +1
-1@@ -2332,7 +2332,7 @@ spider_net_alloc_card(void)struct spider_net_card *card; netdev =alloc_etherdev (struct_size (card, darray, - tx_descriptors + rx_descriptors)); +size_add (tx_descriptors, rx_descriptors)));if (!netdev)return NULL ;
Looks good to me. Thanks for your fix-up.