diff options
| author | Yu Zhe <yuzhe@nfschina.com> | 2022-09-27 09:02:47 +0200 |
|---|---|---|
| committer | Dan Williams <dan.j.williams@intel.com> | 2022-11-03 19:20:46 +0100 |
| commit | 4f1aa35f1fb7d51b125487c835982af792697ecb (patch) | |
| tree | 2c15f9ba2523e709f8bdfc6325bfb7aa81abf5be /drivers | |
| parent | cxl/region: Fix decoder allocation crash (diff) | |
| download | linux-4f1aa35f1fb7d51b125487c835982af792697ecb.tar.xz linux-4f1aa35f1fb7d51b125487c835982af792697ecb.zip | |
cxl/pmem: Use size_add() against integer overflow
"struct_size() + n" may cause a integer overflow,
use size_add() to handle it.
Signed-off-by: Yu Zhe <yuzhe@nfschina.com>
Link: https://lore.kernel.org/r/20220927070247.23148-1-yuzhe@nfschina.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/cxl/pmem.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/cxl/pmem.c b/drivers/cxl/pmem.c index 115a7b79f343..0bac05d804bc 100644 --- a/drivers/cxl/pmem.c +++ b/drivers/cxl/pmem.c @@ -148,7 +148,7 @@ static int cxl_pmem_set_config_data(struct cxl_dev_state *cxlds, return -EINVAL; /* 4-byte status follows the input data in the payload */ - if (struct_size(cmd, in_buf, cmd->in_length) + 4 > buf_len) + if (size_add(struct_size(cmd, in_buf, cmd->in_length), 4) > buf_len) return -EINVAL; set_lsa = |