Skip to contentSkip to conversation

usb: dwc2: Use flex_array_size() helper

PATCH In review Gustavo A. R. Silva 2 participants 2 messages Jan 11, 2022 – Jan 14, 2022

Subsystems (2)
USB DesignWare USB2 DRD IP driver
lore
Share & tools
lore

Gustavo A. R. Silva

author
#0 lore raw

PATCH 1/1 usb: dwc2: Use flex_array_size() helper

Make use of the flex_array_size() helper to calculate the size of a flexible array member within an enclosing structure.

This helper offers defense-in-depth against potential integer overflows, while at the same time makes it explicitly clear that we are dealing with a flexible array member.

Link https://github.com/KSPP/linux/issues/160
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 drivers/usb/dwc2/hcd.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/dwc2/hcd.c +3 -2
index f63a27d11fac..2c21498662cd 100644
@@ -4054,8 +4054,9 @@ struct dwc2_tt *dwc2_host_get_tt_info(struct dwc2_hsotg *hsotg, void *context,
 			 * For single_tt we need one schedule.  For multi_tt
 			 * we need one per port.
 			 */
-			bitmap_size = DWC2_ELEMENTS_PER_LS_BITMAP *
-				      sizeof(dwc_tt->periodic_bitmaps[0]);
+			bitmap_size =
+				flex_array_size(dwc_tt, periodic_bitmaps,
+						DWC2_ELEMENTS_PER_LS_BITMAP);
 			if (urb->dev->tt->multi)
 				bitmap_size *= urb->dev->tt->hub->maxchild;
Signature · 1 line
2.27.0
#1 lore raw

Hi,

Quoted 19 lines · Gustavo A. R. Silva

Make use of the flex_array_size() helper to calculate the size of a flexible array member within an enclosing structure.

This helper offers defense-in-depth against potential integer overflows, while at the same time makes it explicitly clear that we are dealing with a flexible array member.

Link https://urldefense.com/v3/__https://github.com/KSPP/linux/issues/160__;!!A4F2R9G_pg!L8p7TlfbH0sNpL9gtsVuWEZVnP8euMZtJKpc71sXxzEw4MAKWuQ28dJJc0cJTI3bWXLm$
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 drivers/usb/dwc2/hcd.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/dwc2/hcd.c +0 -0
index f63a27d11fac..2c21498662cd 100644
@@ -4054,8 +4054,9 @@ struct dwc2_tt *dwc2_host_get_tt_info(struct dwc2_hsotg *hsotg, void *context,
 			 * For single_tt we need one schedule.  For multi_tt

drivers/usb/dwc2/hcd.c struct dwc2_tt *dwc2_host_get_tt_info(struct dwc2_hsotg *hsotg, void *context, · line 4062

Quoted 10 lines
drivers/usb/dwc2/hcd.c +3 -2
 			 * we need one per port.
 			 */
-			bitmap_size = DWC2_ELEMENTS_PER_LS_BITMAP *
-				      sizeof(dwc_tt->periodic_bitmaps[0]);
+			bitmap_size =
+				flex_array_size(dwc_tt, periodic_bitmaps,
+						DWC2_ELEMENTS_PER_LS_BITMAP);
 			if (urb->dev->tt->multi)
 				bitmap_size *= urb->dev->tt->hub->maxchild;

This doesn't look right even though the result will be the same. The return value from flex_array_size() may not be the final array size as you can see that bitmap_size gets updated again a couple lines down.

How about this instead:

drivers/usb/dwc2/hcd.c +4 -5
index f63a27d11fac..0936ff8b57db 100644
@@ -4048,18 +4048,17 @@ struct dwc2_tt *dwc2_host_get_tt_info(struct dwc2_hsotg *hsotg, void *context,
 
                dwc_tt = urb->dev->tt->hcpriv;
                if (!dwc_tt) {
-                       size_t bitmap_size;
+                       int count;
 
                        /*
                         * For single_tt we need one schedule.  For multi_tt
                         * we need one per port.
                         */
-                       bitmap_size = DWC2_ELEMENTS_PER_LS_BITMAP *
-                                     sizeof(dwc_tt->periodic_bitmaps[0]);
+                       count = DWC2_ELEMENTS_PER_LS_BITMAP;
                        if (urb->dev->tt->multi)
-                               bitmap_size *= urb->dev->tt->hub->maxchild;
+                               count *= urb->dev->tt->hub->maxchild;
 
-                       dwc_tt = kzalloc(sizeof(*dwc_tt) + bitmap_size,
+                       dwc_tt = kzalloc(struct_size(dwc_tt, periodic_bitmaps, count),
                                         mem_flags);
                        if (!dwc_tt)
                                return NULL;

BR,
Thinh