| Message ID | 20180823173125.GA24762@embeddedor.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | usb: iowarrior: replace kmalloc with kmalloc_array | expand |
Hi, Please, drop this. I'll align GFP_KERNEL and send v2. Thanks -- Gustavo On 8/23/18 12:31 PM, Gustavo A. R. Silva wrote: > A common flaw in the kernel is integer overflow during memory allocation > size calculations. In an effort to reduce the frequency of these bugs, > kmalloc_array was implemented, which allocates memory for an array, > while at the same time detects integer overflow. > > This patch replaces cases of: > > kmalloc(a * b, gfp) > > with: > kmalloc_array(a * b, gfp) > > Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> > --- > drivers/usb/misc/iowarrior.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c > index c2991b8..7a22400 100644 > --- a/drivers/usb/misc/iowarrior.c > +++ b/drivers/usb/misc/iowarrior.c > @@ -808,7 +808,7 @@ static int iowarrior_probe(struct usb_interface *interface, > dev->int_in_endpoint->bInterval); > /* create an internal buffer for interrupt data from the device */ > dev->read_queue = > - kmalloc(((dev->report_size + 1) * MAX_INTERRUPT_BUFFER), > + kmalloc_array(dev->report_size + 1, MAX_INTERRUPT_BUFFER, > GFP_KERNEL); > if (!dev->read_queue) > goto error; >
On 8/23/18 12:43 PM, Kees Cook wrote: > On Thu, Aug 23, 2018 at 10:31 AM, Gustavo A. R. Silva > <gustavo@embeddedor.com> wrote: >> A common flaw in the kernel is integer overflow during memory allocation >> size calculations. In an effort to reduce the frequency of these bugs, >> kmalloc_array was implemented, which allocates memory for an array, >> while at the same time detects integer overflow. >> >> This patch replaces cases of: >> >> kmalloc(a * b, gfp) >> >> with: >> kmalloc_array(a * b, gfp) > > nit: this should be "kmalloc_array(a, b, gfp)" (This was a typo from > my treewide commit message... :P) > Oops... OK. V3 is on the way. :P >> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> >> --- >> drivers/usb/misc/iowarrior.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c >> index c2991b8..7a22400 100644 >> --- a/drivers/usb/misc/iowarrior.c >> +++ b/drivers/usb/misc/iowarrior.c >> @@ -808,7 +808,7 @@ static int iowarrior_probe(struct usb_interface *interface, >> dev->int_in_endpoint->bInterval); >> /* create an internal buffer for interrupt data from the device */ >> dev->read_queue = >> - kmalloc(((dev->report_size + 1) * MAX_INTERRUPT_BUFFER), >> + kmalloc_array(dev->report_size + 1, MAX_INTERRUPT_BUFFER, >> GFP_KERNEL); > > For this patch with the commit log updated: > > Reviewed-by: Kees Cook <keescook@chromium.org> > Thanks! -- Gustavo
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c index c2991b8..7a22400 100644 --- a/drivers/usb/misc/iowarrior.c +++ b/drivers/usb/misc/iowarrior.c @@ -808,7 +808,7 @@ static int iowarrior_probe(struct usb_interface *interface, dev->int_in_endpoint->bInterval); /* create an internal buffer for interrupt data from the device */ dev->read_queue = - kmalloc(((dev->report_size + 1) * MAX_INTERRUPT_BUFFER), + kmalloc_array(dev->report_size + 1, MAX_INTERRUPT_BUFFER, GFP_KERNEL); if (!dev->read_queue) goto error;
A common flaw in the kernel is integer overflow during memory allocation size calculations. In an effort to reduce the frequency of these bugs, kmalloc_array was implemented, which allocates memory for an array, while at the same time detects integer overflow. This patch replaces cases of: kmalloc(a * b, gfp) with: kmalloc_array(a * b, gfp) Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> --- drivers/usb/misc/iowarrior.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)