Commit e11c0e25 authored by Gustavo A. R. Silva's avatar Gustavo A. R. Silva Committed by David S. Miller
Browse files

net/ipv6/mcast: Use struct_size() helper 



Replace IP6_SFLSIZE() with struct_size() helper in order to avoid any
potential type mistakes or integer overflows that, in the worst
scenario, could lead to heap overflows.

Signed-off-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e6a1f7e0

include/net/if_inet6.h

+0 −3
Original line number Diff line number Diff line
@@ -82,9 +82,6 @@ struct ip6_sf_socklist { 
	struct in6_addr		sl_addr[];

};



#define IP6_SFLSIZE(count)	(sizeof(struct ip6_sf_socklist) + \

	(count) * sizeof(struct in6_addr))



#define IP6_SFBLOCK	10	/* allocate this many at once */



struct ipv6_mc_socklist {

net/ipv6/mcast.c

+13 −7
Original line number Diff line number Diff line
@@ -447,7 +447,8 @@ int ip6_mc_source(int add, int omode, struct sock *sk, 


		if (psl)

			count += psl->sl_max;

		newpsl = sock_kmalloc(sk, IP6_SFLSIZE(count), GFP_KERNEL);

		newpsl = sock_kmalloc(sk, struct_size(newpsl, sl_addr, count),

				      GFP_KERNEL);

		if (!newpsl) {

			err = -ENOBUFS;

			goto done;
@@ -457,7 +458,8 @@ int ip6_mc_source(int add, int omode, struct sock *sk, 
		if (psl) {

			for (i = 0; i < psl->sl_count; i++)

				newpsl->sl_addr[i] = psl->sl_addr[i];

			atomic_sub(IP6_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);

			atomic_sub(struct_size(psl, sl_addr, psl->sl_max),

				   &sk->sk_omem_alloc);

			kfree_rcu(psl, rcu);

		}

		psl = newpsl;
@@ -525,7 +527,8 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf, 
		goto done;

	}

	if (gsf->gf_numsrc) {

		newpsl = sock_kmalloc(sk, IP6_SFLSIZE(gsf->gf_numsrc),

		newpsl = sock_kmalloc(sk, struct_size(newpsl, sl_addr,

						      gsf->gf_numsrc),

				      GFP_KERNEL);

		if (!newpsl) {

			err = -ENOBUFS;
@@ -543,7 +546,8 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf, 
				     newpsl->sl_count, newpsl->sl_addr, 0);

		if (err) {

			mutex_unlock(&idev->mc_lock);

			sock_kfree_s(sk, newpsl, IP6_SFLSIZE(newpsl->sl_max));

			sock_kfree_s(sk, newpsl, struct_size(newpsl, sl_addr,

							     newpsl->sl_max));

			goto done;

		}

		mutex_unlock(&idev->mc_lock);
@@ -559,7 +563,8 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf, 
	if (psl) {

		ip6_mc_del_src(idev, group, pmc->sfmode,

			       psl->sl_count, psl->sl_addr, 0);

		atomic_sub(IP6_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);

		atomic_sub(struct_size(psl, sl_addr, psl->sl_max),

			   &sk->sk_omem_alloc);

		kfree_rcu(psl, rcu);

	} else {

		ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
@@ -2607,7 +2612,8 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml, 
		err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode,

				     psl->sl_count, psl->sl_addr, 0);

		RCU_INIT_POINTER(iml->sflist, NULL);

		atomic_sub(IP6_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);

		atomic_sub(struct_size(psl, sl_addr, psl->sl_max),

			   &sk->sk_omem_alloc);

		kfree_rcu(psl, rcu);

	}