On 2018-08-26 2:19 a.m., Kees Cook wrote:

On Sat, Aug 25, 2018 at 11:15 PM, Al Viro [off-list ref] wrote:

quoted

On Sat, Aug 25, 2018 at 10:58:01PM -0700, Kees Cook wrote:
Saner approach would be sel_size = offsetof(struct tc_u32_sel, keys[s->nkeys])...

Either is fine by me.

quoted

quoted

+     sel_size = struct_size(s, keys, s->nkeys);
+     if (nla_len(tb[TCA_U32_SEL]) < sel_size) {
+             err = -EINVAL;
+             goto erridr;
+     }

-     n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL);
+     n = kzalloc(offsetof(typeof(*n), sel) + sel_size, GFP_KERNEL);

ITYM
         n = kzalloc(offsetof(struct tc_u_common, sel.keys[s->nkeys]), GFP_KERNEL);

I prefer to reuse sel_size and keep typeof() to keep things tied to
"n" more directly. *shrug*

Looks good to me.
We should add an nla_policy later.

Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>

cheers,
jamal