Commit c20bda34 authored by Gustavo A. R. Silva's avatar Gustavo A. R. Silva Committed by Martin K. Petersen
Browse files

scsi: target: tcmu: Use struct_size() helper in kmalloc() 

Make use of the struct_size() helper instead of an open-coded version, in
order to avoid any potential type mistakes or integer overflows that, in
the worst scenario, could lead to heap overflows.

Link: https://github.com/KSPP/linux/issues/160
Link: https://lore.kernel.org/r/20210927224344.GA190701@embeddedor


Reviewed-by: default avatarBodo Stroesser <bostroesser@gmail.com>
Signed-off-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 5384ee08

drivers/target/target_core_user.c

+1 −2
Original line number Diff line number Diff line
@@ -1255,7 +1255,6 @@ tcmu_tmr_notify(struct se_device *se_dev, enum tcm_tmreq_table tmf, 
{

	int i = 0, cmd_cnt = 0;

	bool unqueued = false;

	uint16_t *cmd_ids = NULL;

	struct tcmu_cmd *cmd;

	struct se_cmd *se_cmd;

	struct tcmu_tmr *tmr;
@@ -1292,7 +1291,7 @@ tcmu_tmr_notify(struct se_device *se_dev, enum tcm_tmreq_table tmf, 
	pr_debug("TMR event %d on dev %s, aborted cmds %d, afflicted cmd_ids %d\n",

		 tcmu_tmr_type(tmf), udev->name, i, cmd_cnt);



	tmr = kmalloc(sizeof(*tmr) + cmd_cnt * sizeof(*cmd_ids), GFP_NOIO);

	tmr = kmalloc(struct_size(tmr, tmr_cmd_ids, cmd_cnt), GFP_NOIO);

	if (!tmr)

		goto unlock;