net/mlx4: Use array_size() helper in copy_to_user()
Subsystems (4)
PATCH 1/1 net/mlx4: Use array_size() helper in copy_to_user()
Use array_size() helper instead of the open-coded version in copy_to_user(). These sorts of multiplication factors need to be wrapped in array_size().
--- drivers/net/ethernet/mellanox/mlx4/cq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/cq.c +2 -1
@@ -314,7 +314,8 @@ static int mlx4_init_user_cqes(void *buf, int entries, int cqe_size) buf +=PAGE_SIZE ; } }else { - err =copy_to_user ((void __user *)buf, init_ents, entries * cqe_size) ? + err =copy_to_user ((void __user *)buf, init_ents, +array_size (entries, cqe_size)) ? -EFAULT :0 ; }
Signature · 1 line
2.27.0
Quoted 16 lines · Gustavo A. R. Silva
Use
array_size()helper instead of the open-coded version incopy_to_user(). These sorts of multiplication factors need to be wrapped inarray_size().--- drivers/net/ethernet/mellanox/mlx4/cq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)drivers/net/ethernet/mellanox/mlx4/cq.c +0
-0
drivers/net/ethernet/mellanox/mlx4/cq.c static int mlx4_init_user_cqes(void *buf, int entries, int cqe_size) · line 321
Quoted 9 lines
drivers/net/ethernet/mellanox/mlx4/cq.c +2
-1@@ -314,7 +314,8 @@ static int mlx4_init_user_cqes(void *buf, int entries, int cqe_size) buf +=PAGE_SIZE ; } }else { - err =copy_to_user ((void __user *)buf, init_ents, entries * cqe_size) ? + err =copy_to_user ((void __user *)buf, init_ents, +array_size (entries, cqe_size)) ? -EFAULT :0 ; }
Thanks for your patch.
Quoted 29 lines · Tariq Toukan
Quoted 23 lines · Gustavo A. R. Silva
Use
array_size()helper instead of the open-coded version incopy_to_user(). These sorts of multiplication factors need to be wrapped inarray_size().---
drivers/net/ethernet/mellanox/mlx4/cq.c| 3 ++-1 file changed, 2 insertions(+), 1 deletion(-)drivers/net/ethernet/mellanox/mlx4/cq.c +2
-1@@ -314,7 +314,8 @@ static int mlx4_init_user_cqes(void *buf, int entries, int cqe_size) buf += PAGE_SIZE; } } else { - err = copy_to_user((void __user *)buf, init_ents, entries * cqe_size) ? + err = copy_to_user((void __user *)buf, init_ents, + array_size(entries, cqe_size)) ? -EFAULT : 0; }Quoted 1 line
Thanks for your patch.
Quoted 1 line
Reviewed-by Tariq Toukan <[email protected]>
Not sure why avoiding size_t overflows would make this code safer. init_ents contains PAGE_SIZE bytes...
BTW
Is @entries guaranteed to be a power of two ?
This function seems to either copy one chunk ( <= PAGE_SIZE), or a number of full pages.
Quoted 34 lines · Eric Dumazet
Quoted 29 lines · Tariq Toukan
Quoted 15 lines · Gustavo A. R. Silva
Use
array_size()helper instead of the open-coded version incopy_to_user(). These sorts of multiplication factors need to be wrapped inarray_size().--- drivers/net/ethernet/mellanox/mlx4/cq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)drivers/net/ethernet/mellanox/mlx4/cq.c +0
-0drivers/net/ethernet/mellanox/mlx4/cq.c static int mlx4_init_user_cqes(void *buf, int entries, int cqe_size) · line 321
Quoted 9 lines
drivers/net/ethernet/mellanox/mlx4/cq.c +2
-1@@ -314,7 +314,8 @@ static int mlx4_init_user_cqes(void *buf, int entries, int cqe_size) buf += PAGE_SIZE; } } else { - err = copy_to_user((void __user *)buf, init_ents, entries * cqe_size) ? + err = copy_to_user((void __user *)buf, init_ents, + array_size(entries, cqe_size)) ? -EFAULT : 0; }Thanks for your patch.
Quoted 1 line
Reviewed-by Tariq Toukan <[email protected]>
Quoted 6 lines
Not sure why avoiding
size_toverflows would make this code safer.init_entscontainsPAGE_SIZEbytes...BTW
Is @entries guaranteed to be a power of two ?
Yes.
Quoted 4 lines
This function seems to either copy one chunk ( <=
PAGE_SIZE), or a number of full pages.
Exactly. No remainder handling is needed, for the reason you mentioned above.