Skip to contentSkip to conversation

gve: Use size_add() in call to struct_size()

PATCH Applied Gustavo A. R. Silva 3 participants 3 messages Sep 15, 2023 – Sep 17, 2023

Subsystems (3)
Networking Network drivers Google Ethernet drivers
lore
Share & tools
lore

Gustavo A. R. Silva

author
#0 lore raw

PATCH 1/1 gve: Use size_add() in call to struct_size()

If, for any reason, tx_stats_num + rx_stats_num wraps around, the protection that struct_size() adds against potential integer overflows is defeated. Fix this by hardening call to struct_size() with size_add().

Fixes 691f4077d560 ("gve: Replace zero-length array with flexible-array member")
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 drivers/net/ethernet/google/gve/gve_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/google/gve/gve_main.c +1 -1
index 5704b5f57cd0..83b09dcfafc4 100644
@@ -190,7 +190,7 @@ static int gve_alloc_stats_report(struct gve_priv *priv)
 	rx_stats_num = (GVE_RX_STATS_REPORT_NUM + NIC_RX_STATS_REPORT_NUM) *
 		       priv->rx_cfg.num_queues;
 	priv->stats_report_len = struct_size(priv->stats_report, stats,
-					     tx_stats_num + rx_stats_num);
+					     size_add(tx_stats_num, rx_stats_num));
 	priv->stats_report =
 		dma_alloc_coherent(&priv->pdev->dev, priv->stats_report_len,
 				   &priv->stats_report_bus, GFP_KERNEL);
Signature · 1 line
2.34.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 6 lines · Gustavo A. R. Silva

If, for any reason, tx_stats_num + rx_stats_num wraps around, the protection that struct_size() adds against potential integer overflows is defeated. Fix this by hardening call to struct_size() with size_add().

Fixes 691f4077d560 ("gve: Replace zero-length array with flexible-array member")
Signed-off-by Gustavo A. R. Silva <[email protected]>

Thanks, yes, this will maintain SIZE_MAX saturation if it happens.

Reviewed-by Kees Cook <[email protected]>
Signature · 1 line
Kees Cook
CI Applied
#2 lore raw
In reply to Gustavo A. R. Silva
This patch was applied to netdev/net-next.git (main) by David S. Miller <[email protected]>:

Hello:

This patch was applied to netdev/net-next.git (main) by David S. Miller <[email protected]>:

Quoted 8 lines · On Fri, 15 Sep 2023 12:17:49 -0600 you wrote:

If, for any reason, tx_stats_num + rx_stats_num wraps around, the protection that struct_size() adds against potential integer overflows is defeated. Fix this by hardening call to struct_size() with size_add().

Fixes 691f4077d560 ("gve: Replace zero-length array with flexible-array member")
Signed-off-by Gustavo A. R. Silva <[email protected]>

[...]

Here is the summary with links:
- [next] gve: Use size_add() in call to struct_size()

    https://git.kernel.org/netdev/net-next/c/d692873cbe86

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html