Commit c5eeec3b authored by Gustavo A. R. Silva's avatar Gustavo A. R. Silva Committed by Jialin Zhang
Browse files

net: sched: Use struct_size() helper in kvmalloc() 

mainline inclusion
from mainline-v5.16-rc1
commit 12929198
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6SFHJ
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=129291980f4901ae68ee3ba4344bdc38cf5f800d

--------------------------------

Make use of the struct_size() helper instead of an open-coded version,
in order to avoid any potential type mistakes or integer overflows
that, in the worst scenario, could lead to heap overflows.

Link: https://github.com/KSPP/linux/issues/160


Signed-off-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/20210929201718.GA342296@embeddedor


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
Reviewed-by: default avatarLiu Jian <liujian56@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parent 1c7c1029

net/sched/sch_netem.c

+1 −1
Original line number Diff line number Diff line
@@ -785,7 +785,7 @@ static int get_dist_table(struct Qdisc *sch, struct disttable **tbl, 
	if (!n || n > NETEM_DIST_MAX)

		return -EINVAL;



	d = kvmalloc(sizeof(struct disttable) + n * sizeof(s16), GFP_KERNEL);

	d = kvmalloc(struct_size(d, table, n), GFP_KERNEL);

	if (!d)

		return -ENOMEM;