Messages in this thread |  | | Date | Fri, 16 Dec 2022 15:42:47 -0800 | From | Kees Cook <> | Subject | Re: [PATCH v3] [next] pcmcia: synclink_cs: replace 1-element array with flex-array member |
| |
On Sat, Dec 17, 2022 at 11:59:06AM +1300, Paulo Miguel Almeida wrote: > One-element arrays are deprecated, and we are replacing them with > flexible array members instead. So, replace one-element array with > flexible-array member in struct RXBUF and refactor the rest of the code > accordingly. While at it, fix an edge case which could cause > rx_buf_count to be 0 when max_frame_size was set to the maximum > allowed value (65535). > > It's worth mentioning that struct RXBUF was allocating 1 byte "too much" > for what is required (ignoring bytes added by padding).
What was the result of using __packed to make sure there wasn't a sizing error?
-Kees
> > This helps with the ongoing efforts to tighten the FORTIFY_SOURCE > routines on memcpy() and help us make progress towards globally > enabling -fstrict-flex-arrays=3 [1]. > > Link: https://github.com/KSPP/linux/issues/79 > Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101836 [1] > Signed-off-by: Paulo Miguel Almeida <paulo.miguel.almeida.rodenas@gmail.com> > --- > Changelog: > > - v3: > fix size calculation mistakes using overflow.h macros: (Req: Andy > Shevchenko, Kees Cook) > add notes struct RXBUF size (Kees Cook) > > - v2: removed changes to how the size of RXBUF was calculated. I > changed my mind after thinking about the existing padding in the > struct. Happy to discuss it if anyone sees it differently. > > - v1: https://lore.kernel.org/lkml/Y5mMWEtHWKOiPVU+@mail.google.com/ > --- > drivers/char/pcmcia/synclink_cs.c | 33 +++++++++++++++++++------------ > 1 file changed, 20 insertions(+), 13 deletions(-) > > diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c > index b2735be81ab2..eee6772a0978 100644 > --- a/drivers/char/pcmcia/synclink_cs.c > +++ b/drivers/char/pcmcia/synclink_cs.c > @@ -105,7 +105,7 @@ static MGSL_PARAMS default_params = { > typedef struct { > int count; > unsigned char status; > - char data[1]; > + char data[]; > } RXBUF; > > /* The queue of BH actions to be performed */ > @@ -229,12 +229,18 @@ typedef struct _mgslpc_info { > } MGSLPC_INFO; > > #define MGSLPC_MAGIC 0x5402 > +#define MGSLPC_MAX_FRAME_SIZE 65535 > +#define MGSLPC_MIN_FRAME_SIZE 4096 > > /* > * The size of the serial xmit buffer is 1 page, or 4096 bytes > */ > #define TXBUFSIZE 4096 > > +/* > + * RXBUF accommodates at least 1 buffer (header+data) of MGSLPC_MAX_FRAME_SIZE > + */ > +#define RXBUF_MAX_SIZE (sizeof(RXBUF) + MGSLPC_MAX_FRAME_SIZE) > > #define CHA 0x00 /* channel A offset */ > #define CHB 0x40 /* channel B offset */ > @@ -529,7 +535,7 @@ static int mgslpc_probe(struct pcmcia_device *link) > tty_port_init(&info->port); > info->port.ops = &mgslpc_port_ops; > INIT_WORK(&info->task, bh_handler); > - info->max_frame_size = 4096; > + info->max_frame_size = MGSLPC_MIN_FRAME_SIZE; > init_waitqueue_head(&info->status_event_wait_q); > init_waitqueue_head(&info->event_wait_q); > spin_lock_init(&info->lock); > @@ -2611,19 +2617,20 @@ static int mgslpc_proc_show(struct seq_file *m, void *v) > static int rx_alloc_buffers(MGSLPC_INFO *info) > { > /* each buffer has header and data */ > - info->rx_buf_size = sizeof(RXBUF) + info->max_frame_size; > + if (check_add_overflow(sizeof(RXBUF), info->max_frame_size, &info->rx_buf_size)) > + return -EINVAL; > > - /* calculate total allocation size for 8 buffers */ > - info->rx_buf_total_size = info->rx_buf_size * 8; > + /* try to alloc as many buffers that can fit within RXBUF_MAX_SIZE (up to 8) */ > + if (check_mul_overflow(info->rx_buf_size, 8, &info->rx_buf_total_size)) > + return -EINVAL; > > - /* limit total allocated memory */ > - if (info->rx_buf_total_size > 0x10000) > - info->rx_buf_total_size = 0x10000; > + if (info->rx_buf_total_size > RXBUF_MAX_SIZE) > + info->rx_buf_total_size = RXBUF_MAX_SIZE; > > /* calculate number of buffers */ > info->rx_buf_count = info->rx_buf_total_size / info->rx_buf_size; > > - info->rx_buf = kmalloc(info->rx_buf_total_size, GFP_KERNEL); > + info->rx_buf = kcalloc(info->rx_buf_count, info->rx_buf_size, GFP_KERNEL); > if (info->rx_buf == NULL) > return -ENOMEM; > > @@ -2695,10 +2702,10 @@ static int mgslpc_add_device(MGSLPC_INFO *info) > current_dev->next_device = info; > } > > - if (info->max_frame_size < 4096) > - info->max_frame_size = 4096; > - else if (info->max_frame_size > 65535) > - info->max_frame_size = 65535; > + if (info->max_frame_size < MGSLPC_MIN_FRAME_SIZE) > + info->max_frame_size = MGSLPC_MIN_FRAME_SIZE; > + else if (info->max_frame_size > MGSLPC_MAX_FRAME_SIZE) > + info->max_frame_size = MGSLPC_MAX_FRAME_SIZE; > > printk("SyncLink PC Card %s:IO=%04X IRQ=%d\n", > info->device_name, info->io_base, info->irq_level); > -- > 2.38.1 >
-- Kees Cook
|  |