Skip to content

Commit

Permalink
net: spider_net: Use size_add() in call to struct_size()
Browse files Browse the repository at this point in the history
If, for any reason, the open-coded arithmetic causes a wraparound,
the protection that `struct_size()` adds against potential integer
overflows is defeated. Fix this by hardening call to `struct_size()`
with `size_add()`.

Fixes: 3f1071e ("net: spider_net: Use struct_size() helper")
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Gustavo A. R. Silva authored and David S. Miller committed Sep 18, 2023
1 parent 2506a91 commit 0201409
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/net/ethernet/toshiba/spider_net.c
Original file line number Diff line number Diff line change
Expand Up @@ -2332,7 +2332,7 @@ spider_net_alloc_card(void)
struct spider_net_card *card;

netdev = alloc_etherdev(struct_size(card, darray,
tx_descriptors + rx_descriptors));
size_add(tx_descriptors, rx_descriptors)));
if (!netdev)
return NULL;

Expand Down

0 comments on commit 0201409

Please sign in to comment.