diff options
| author | Gustavo A. R. Silva <gustavoars@kernel.org> | 2022-02-07 17:39:23 -0600 |
|---|---|---|
| committer | Lyude Paul <lyude@redhat.com> | 2022-02-08 15:11:22 -0500 |
| commit | 2a3950c43e2ead47ed7456b04da5d4afde58c4b2 (patch) | |
| tree | dfe1d7a6e40b1935101e8e468aa5b74317e53b21 | |
| parent | 5e78d59a1ead969669f64dde4245cfa65b7cc4a9 (diff) | |
| download | linux-2a3950c43e2ead47ed7456b04da5d4afde58c4b2.tar.gz linux-2a3950c43e2ead47ed7456b04da5d4afde58c4b2.tar.bz2 linux-2a3950c43e2ead47ed7456b04da5d4afde58c4b2.zip | |
nouveau/svm: Use struct_size() helper in nouveau_pfns_map()
Make use of the struct_size() helper instead of an open-coded version,
in order to avoid any potential type mistakes or integer overflows that,
in the worse scenario, could lead to heap overflows.
Link: https://github.com/KSPP/linux/issues/160
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220207233923.GA524723@embeddedor
| -rw-r--r-- | drivers/gpu/drm/nouveau/nouveau_svm.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c index 266809e511e2..46a5a1016e37 100644 --- a/drivers/gpu/drm/nouveau/nouveau_svm.c +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c @@ -925,8 +925,8 @@ nouveau_pfns_map(struct nouveau_svmm *svmm, struct mm_struct *mm, mutex_lock(&svmm->mutex); - ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, sizeof(*args) + - npages * sizeof(args->p.phys[0]), NULL); + ret = nvif_object_ioctl(&svmm->vmm->vmm.object, args, + struct_size(args, p.phys, npages), NULL); mutex_unlock(&svmm->mutex); } |