Commit 7d7f8fe4 authored by Dan Carpenter's avatar Dan Carpenter Committed by Mathieu Poirier
Browse files

remoteproc: Harden rproc_handle_vdev() against integer overflow 



The struct_size() macro protects against integer overflows but adding
"+ rsc->config_len" introduces the risk of integer overflows again.
Use size_add() to be safe.

Fixes: c8784657 ("remoteproc: use struct_size() helper")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: default avatarMukesh Ojha <quic_mojha@quicinc.com>
Link: https://lore.kernel.org/r/YyMyoPoGOJUcEpZT@kili


Signed-off-by: default avatarMathieu Poirier <mathieu.poirier@linaro.org>
parent fa25b944

drivers/remoteproc/remoteproc_core.c

+3 −2
Original line number Diff line number Diff line
@@ -520,12 +520,13 @@ static int rproc_handle_vdev(struct rproc *rproc, void *ptr, 
	struct fw_rsc_vdev *rsc = ptr;

	struct device *dev = &rproc->dev;

	struct rproc_vdev *rvdev;

	size_t rsc_size;

	int i, ret;

	char name[16];



	/* make sure resource isn't truncated */

	if (struct_size(rsc, vring, rsc->num_of_vrings) + rsc->config_len >

			avail) {

	rsc_size = struct_size(rsc, vring, rsc->num_of_vrings);

	if (size_add(rsc_size, rsc->config_len) > avail) {

		dev_err(dev, "vdev rsc is truncated\n");

		return -EINVAL;

	}