apparmor: Use struct_size() helper in kzalloc()
Subsystems (2)
PATCH 1/1 apparmor: Use struct_size() helper in kzalloc()
Make use of the struct_size() helper instead of an open-coded version, in order to avoid any potential type mistakes or integer overflows that, in the worse scenario, could lead to heap overflows.
--- security/apparmor/label.c | 3 +-- security/apparmor/policy.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-)
security/apparmor/label.c +1 -2
@@ -425,8 +425,7 @@ struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)AA_BUG (size <1 );/* + 1 for null terminator entry on vec */ - new =kzalloc (sizeof (*new) +sizeof (struct aa_profile *) * (size +1 ), - gfp); + new =kzalloc (struct_size (new, vec, size +1 ), gfp);AA_DEBUG ("%s (%p)\n" , __func__, new);if (!new) goto fail;
security/apparmor/policy.c +1 -2
@@ -260,8 +260,7 @@ struct aa_profile *aa_alloc_profile(const char *hname, struct aa_proxy *proxy,struct aa_profile *profile;/* freed by free_profile - usually through aa_put_profile */ - profile =kzalloc (sizeof (*profile) +sizeof (struct aa_profile *) *2 , - gfp); + profile =kzalloc (struct_size (profile, label.vec,2 ), gfp);if (!profile)return NULL ;
Signature · 1 line
2.27.0
Quoted 5 lines · Gustavo A. R. Silva
Make use of the
struct_size()helper instead of an open-coded version, in order to avoid any potential type mistakes or integer overflows that, in the worse scenario, could lead to heap overflows.Quoted 1 line
Signed-off-by Gustavo A. R. Silva <[email protected]>
nice
I will pull this into my tree
Acked-by John Johansen <[email protected]>
Quoted 34 lines
--- security/apparmor/label.c | 3 +-- security/apparmor/policy.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-)security/apparmor/label.c +1
-2@@ -425,8 +425,7 @@ struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)AA_BUG (size <1 );/* + 1 for null terminator entry on vec */ - new =kzalloc (sizeof (*new) +sizeof (struct aa_profile *) * (size +1 ), - gfp); + new =kzalloc (struct_size (new, vec, size +1 ), gfp);AA_DEBUG ("%s (%p)\n" , __func__, new);if (!new) goto fail;security/apparmor/policy.c +1
-2@@ -260,8 +260,7 @@ struct aa_profile *aa_alloc_profile(const char *hname, struct aa_proxy *proxy,struct aa_profile *profile;/* freed by free_profile - usually through aa_put_profile */ - profile =kzalloc (sizeof (*profile) +sizeof (struct aa_profile *) *2 , - gfp); + profile =kzalloc (struct_size (profile, label.vec,2 ), gfp);if (!profile)return NULL ;
Quoted 11 lines · John Johansen
Quoted 5 lines · Gustavo A. R. Silva
Make use of the
struct_size()helper instead of an open-coded version, in order to avoid any potential type mistakes or integer overflows that, in the worse scenario, could lead to heap overflows.Quoted 1 line
Signed-off-by Gustavo A. R. Silva <[email protected]>nice
I will pull this into my tree
Acked-by John Johansen <[email protected]>
Thanks, John.
--
Gustavo