Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

dmaengine: at_xdmac: Use struct_size() in devm_kzalloc()

Make use of the struct_size() helper instead of an open-coded version, in
order to avoid any potential type mistakes or integer overflows that, in
the worst scenario, could lead to heap overflows.

Link: https://github.com/KSPP/linux/issues/160
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20211208001013.GA62330@embeddedor
Signed-off-by: Vinod Koul <vkoul@kernel.org>

authored by

Gustavo A. R. Silva and committed by
Vinod Koul
aa8ff35e f17e5338

+4 -4
+4 -4
drivers/dma/at_xdmac.c
··· 2031 2031 static int at_xdmac_probe(struct platform_device *pdev) 2032 2032 { 2033 2033 struct at_xdmac *atxdmac; 2034 - int irq, size, nr_channels, i, ret; 2034 + int irq, nr_channels, i, ret; 2035 2035 void __iomem *base; 2036 2036 u32 reg; 2037 2037 ··· 2056 2056 return -EINVAL; 2057 2057 } 2058 2058 2059 - size = sizeof(*atxdmac); 2060 - size += nr_channels * sizeof(struct at_xdmac_chan); 2061 - atxdmac = devm_kzalloc(&pdev->dev, size, GFP_KERNEL); 2059 + atxdmac = devm_kzalloc(&pdev->dev, 2060 + struct_size(atxdmac, chan, nr_channels), 2061 + GFP_KERNEL); 2062 2062 if (!atxdmac) { 2063 2063 dev_err(&pdev->dev, "can't allocate at_xdmac structure\n"); 2064 2064 return -ENOMEM;