Thread (5 messages) 5 messages, 2 authors, 2025-03-07

less size_t please (was Re: [PATCH net] xfrm: fix integer overflow in xfrm_replay_state_esn_len())

From: Alexey Dobriyan <hidden>
Date: 2025-01-30 13:44:46
Also in: kernel-janitors, lkml

-static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
+static inline size_t xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay_esn)
 {
-	return sizeof(*replay_esn) + replay_esn->bmp_len * sizeof(__u32);
+	return size_add(sizeof(*replay_esn), size_mul(replay_esn->bmp_len, sizeof(__u32)));
Please don't do this.

You can (and should!) make calculations and check for overflow at the
same time. It's very efficient.
1) Use size_add() and size_mul().  This change is necessary for 32bit systems.
This bloats code on 32-bit.

	int len;
	if (__builtin_mul_overflow(replay_esn->bmp_len, 4, &len)) {
		return true;
	}
	if (__builtin_add_overflow(len, sizeof(*replay_esn), &len)) {
		return true;
	}
	*plen = len;
	return false;
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help