Re: [RFC PATCH 5/7] firmware: arm_scmi: Add System Telemetry chardev/ioctls API
flat view
From: Dan Carpenter <hidden>
Date: 2025-06-20 21:51:17
Also in:
arm-scmi, lkml
On Fri, Jun 20, 2025 at 08:28:11PM +0100, Cristian Marussi wrote:
quoted hunk ↗ jump to hunk
+static long scmi_tlm_des_read_ioctl(struct scmi_tlm_instance *ti, + unsigned long arg, bool single) +{ + void * __user uptr = (void * __user)arg; + struct scmi_tlm_setup *tsp = ti->tsp; + struct scmi_tlm_bulk_read bulk, *bulk_ptr; + int ret; + + if (copy_from_user(&bulk, uptr, sizeof(bulk))) + return -EFAULT; + + bulk_ptr = kzalloc(sizeof(*bulk_ptr) + + bulk.num_samples * sizeof(bulk_ptr->samples[0]),
This should be struct_size(bulk_ptr, samples, bulk.num_samples) to avoid an integer overflow on 32bit systems. regards, dan carpenter
quoted hunk ↗ jump to hunk
+ GFP_KERNEL); + if (!bulk_ptr) + return -ENOMEM; + + bulk_ptr->grp_id = bulk.grp_id; + bulk_ptr->num_samples = bulk.num_samples; + if (!single) + ret = tsp->ops->des_bulk_read(tsp->ph, bulk_ptr->grp_id, + &bulk_ptr->num_samples, + (struct scmi_telemetry_de_sample *)bulk_ptr->samples); + else + ret = tsp->ops->des_sample_get(tsp->ph, bulk_ptr->grp_id, + &bulk_ptr->num_samples, + (struct scmi_telemetry_de_sample *)bulk_ptr->samples); + if (ret) + goto out; + + if (copy_to_user(uptr, bulk_ptr, sizeof(*bulk_ptr) + + bulk_ptr->num_samples * sizeof(bulk_ptr->samples[0]))) + ret = -EFAULT; + +out: + kfree(bulk_ptr); + + return ret; +}