Commit e6a1f7e0 authored by Gustavo A. R. Silva's avatar Gustavo A. R. Silva Committed by David S. Miller
Browse files

net/ipv4/igmp: Use struct_size() helper 



Replace IP_SFLSIZE() with struct_size() helper in order to avoid any
potential type mistakes or integer overflows that, in the worst
scenario, could lead to heap overflows.

Signed-off-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent db243b79

include/linux/igmp.h

+0 −3
Original line number Diff line number Diff line
@@ -41,9 +41,6 @@ struct ip_sf_socklist { 
	__be32			sl_addr[];

};



#define IP_SFLSIZE(count)	(sizeof(struct ip_sf_socklist) + \

	(count) * sizeof(__be32))



#define IP_SFBLOCK	10	/* allocate this many at once */



/* ip_mc_socklist is real list now. Speed is not argument;

net/ipv4/igmp.c

+13 −7
Original line number Diff line number Diff line
@@ -2233,7 +2233,7 @@ static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml, 
			iml->sfmode, psf->sl_count, psf->sl_addr, 0);

	RCU_INIT_POINTER(iml->sflist, NULL);

	/* decrease mem now to avoid the memleak warning */

	atomic_sub(IP_SFLSIZE(psf->sl_max), &sk->sk_omem_alloc);

	atomic_sub(struct_size(psf, sl_addr, psf->sl_max), &sk->sk_omem_alloc);

	kfree_rcu(psf, rcu);

	return err;

}
@@ -2382,7 +2382,8 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct 


		if (psl)

			count += psl->sl_max;

		newpsl = sock_kmalloc(sk, IP_SFLSIZE(count), GFP_KERNEL);

		newpsl = sock_kmalloc(sk, struct_size(newpsl, sl_addr, count),

				      GFP_KERNEL);

		if (!newpsl) {

			err = -ENOBUFS;

			goto done;
@@ -2393,7 +2394,8 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct 
			for (i = 0; i < psl->sl_count; i++)

				newpsl->sl_addr[i] = psl->sl_addr[i];

			/* decrease mem now to avoid the memleak warning */

			atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);

			atomic_sub(struct_size(psl, sl_addr, psl->sl_max),

				   &sk->sk_omem_alloc);

			kfree_rcu(psl, rcu);

		}

		rcu_assign_pointer(pmc->sflist, newpsl);
@@ -2468,7 +2470,8 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex) 
		goto done;

	}

	if (msf->imsf_numsrc) {

		newpsl = sock_kmalloc(sk, IP_SFLSIZE(msf->imsf_numsrc),

		newpsl = sock_kmalloc(sk, struct_size(newpsl, sl_addr,

						      msf->imsf_numsrc),

				      GFP_KERNEL);

		if (!newpsl) {

			err = -ENOBUFS;
@@ -2480,7 +2483,9 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex) 
		err = ip_mc_add_src(in_dev, &msf->imsf_multiaddr,

			msf->imsf_fmode, newpsl->sl_count, newpsl->sl_addr, 0);

		if (err) {

			sock_kfree_s(sk, newpsl, IP_SFLSIZE(newpsl->sl_max));

			sock_kfree_s(sk, newpsl,

				     struct_size(newpsl, sl_addr,

						 newpsl->sl_max));

			goto done;

		}

	} else {
@@ -2493,7 +2498,8 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex) 
		(void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,

			psl->sl_count, psl->sl_addr, 0);

		/* decrease mem now to avoid the memleak warning */

		atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);

		atomic_sub(struct_size(psl, sl_addr, psl->sl_max),

			   &sk->sk_omem_alloc);

		kfree_rcu(psl, rcu);

	} else

		(void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,