[PATCH 31/32] xenbus: Use mem_to_flex_dup() with struct read_buffer
From: Kees Cook <hidden>
Date: 2022-05-04 01:59:17
Also in:
keyrings, linux-arm-msm, linux-bluetooth, linux-devicetree, linux-hardening, linux-hyperv, linux-integrity, linux-rdma, linux-scsi, linux-usb, linux-wireless, llvm, netdev, selinux, xen-devel
Subsystem:
the rest, xen hypervisor interface · Maintainers:
Linus Torvalds, Juergen Gross, Stefano Stabellini
As part of the work to perform bounds checking on all memcpy() uses, replace the open-coded a deserialization of bytes out of memory into a trailing flexible array by using a flex_array.h helper to perform the allocation, bounds checking, and copying. Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com> Cc: Juergen Gross <jgross@suse.com> Cc: Stefano Stabellini <sstabellini@kernel.org> Cc: xen-devel@lists.xenproject.org Signed-off-by: Kees Cook <redacted> --- drivers/xen/xenbus/xenbus_dev_frontend.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 597af455a522..4267aaef33fb 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c@@ -81,8 +81,8 @@ struct xenbus_transaction_holder { struct read_buffer { struct list_head list; unsigned int cons; - unsigned int len; - char msg[]; + DECLARE_FLEX_ARRAY_ELEMENTS_COUNT(unsigned int, len); + DECLARE_FLEX_ARRAY_ELEMENTS(char, msg); }; struct xenbus_file_priv {
@@ -188,21 +188,17 @@ static ssize_t xenbus_file_read(struct file *filp, */ static int queue_reply(struct list_head *queue, const void *data, size_t len) { - struct read_buffer *rb; + struct read_buffer *rb = NULL; if (len == 0) return 0; if (len > XENSTORE_PAYLOAD_MAX) return -EINVAL; - rb = kmalloc(sizeof(*rb) + len, GFP_KERNEL); - if (rb == NULL) + if (mem_to_flex_dup(&rb, data, len, GFP_KERNEL)) return -ENOMEM; rb->cons = 0; - rb->len = len; - - memcpy(rb->msg, data, len); list_add_tail(&rb->list, queue); return 0;
--
2.32.0