Commit 2509b561 authored by Kees Cook's avatar Kees Cook
Browse files

device: Use overflow helpers for devm_kmalloc() 



Use the overflow helpers both in existing multiplication-using inlines as
well as the addition-overflow case in the core allocation routine.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 3b3b1a29

drivers/base/devres.c

+6 −1
Original line number Diff line number Diff line
@@ -84,9 +84,14 @@ static struct devres_group * node_to_group(struct devres_node *node) 
static __always_inline struct devres * alloc_dr(dr_release_t release,

						size_t size, gfp_t gfp, int nid)

{

	size_t tot_size = sizeof(struct devres) + size;

	size_t tot_size;

	struct devres *dr;



	/* We must catch any near-SIZE_MAX cases that could overflow. */

	if (unlikely(check_add_overflow(sizeof(struct devres), size,

					&tot_size)))

		return NULL;



	dr = kmalloc_node_track_caller(tot_size, gfp, nid);

	if (unlikely(!dr))

		return NULL;

include/linux/device.h

+6 −2
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 
#include <linux/ratelimit.h>

#include <linux/uidgid.h>

#include <linux/gfp.h>

#include <linux/overflow.h>

#include <asm/device.h>



struct device;
@@ -668,9 +669,12 @@ static inline void *devm_kzalloc(struct device *dev, size_t size, gfp_t gfp) 
static inline void *devm_kmalloc_array(struct device *dev,

				       size_t n, size_t size, gfp_t flags)

{

	if (size != 0 && n > SIZE_MAX / size)

	size_t bytes;



	if (unlikely(check_mul_overflow(n, size, &bytes)))

		return NULL;

	return devm_kmalloc(dev, n * size, flags);



	return devm_kmalloc(dev, bytes, flags);

}

static inline void *devm_kcalloc(struct device *dev,

				 size_t n, size_t size, gfp_t flags)