mirror of
https://github.com/torvalds/linux
synced 2024-10-06 19:34:19 +00:00
xen/gntalloc: Replace UAPI 1-element array
Without changing the structure size (since it is UAPI), add a proper flexible array member, and reference it in the kernel so that it will not be trip the array-bounds sanitizer[1]. Link: https://github.com/KSPP/linux/issues/113 [1] Cc: Juergen Gross <jgross@suse.com> Cc: Stefano Stabellini <sstabellini@kernel.org> Cc: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com> Cc: Gustavo A. R. Silva <gustavoars@kernel.org> Cc: xen-devel@lists.xenproject.org Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://lore.kernel.org/r/20240206170320.work.437-kees@kernel.org Signed-off-by: Juergen Gross <jgross@suse.com>
This commit is contained in:
parent
b0f2f82c9c
commit
bf5802238d
|
@ -317,7 +317,7 @@ static long gntalloc_ioctl_alloc(struct gntalloc_file_private_data *priv,
|
||||||
rc = -EFAULT;
|
rc = -EFAULT;
|
||||||
goto out_free;
|
goto out_free;
|
||||||
}
|
}
|
||||||
if (copy_to_user(arg->gref_ids, gref_ids,
|
if (copy_to_user(arg->gref_ids_flex, gref_ids,
|
||||||
sizeof(gref_ids[0]) * op.count)) {
|
sizeof(gref_ids[0]) * op.count)) {
|
||||||
rc = -EFAULT;
|
rc = -EFAULT;
|
||||||
goto out_free;
|
goto out_free;
|
||||||
|
|
|
@ -31,7 +31,10 @@ struct ioctl_gntalloc_alloc_gref {
|
||||||
__u64 index;
|
__u64 index;
|
||||||
/* The grant references of the newly created grant, one per page */
|
/* The grant references of the newly created grant, one per page */
|
||||||
/* Variable size, depending on count */
|
/* Variable size, depending on count */
|
||||||
__u32 gref_ids[1];
|
union {
|
||||||
|
__u32 gref_ids[1];
|
||||||
|
__DECLARE_FLEX_ARRAY(__u32, gref_ids_flex);
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
#define GNTALLOC_FLAG_WRITABLE 1
|
#define GNTALLOC_FLAG_WRITABLE 1
|
||||||
|
|
Loading…
Reference in a new issue