From nobody Thu Dec 18 04:17:13 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 542D6C07E9D for ; Mon, 26 Sep 2022 12:00:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239139AbiIZMAZ (ORCPT ); Mon, 26 Sep 2022 08:00:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37014 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238943AbiIZL46 (ORCPT ); Mon, 26 Sep 2022 07:56:58 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A084179EDF; Mon, 26 Sep 2022 03:51:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 14B88B807EC; Mon, 26 Sep 2022 10:50:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 601BCC433D7; Mon, 26 Sep 2022 10:50:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1664189456; bh=IRzKGaMuCquRf/sme99rrXbn39SAxWDascXm7dwT+Q4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZPZgnpkgvcGRmJAbYxTxPGNcWHq9b2OvNuewOvF8Km9uxrp/QcFu3s/4Xn9sqDzPM F3Jj7GwCCWI6aeQvTRWTzdj3J4Z814jKyzsw8Zyor+kA+dp7kIVVaK5pANKRleCJpS 3V9ILuMCxusFBVUJ7lJK/mQhaUn3dj+5gCBvC8r0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Peter Rosin , "Gustavo A. R. Silva" , Wolfram Sang , Sasha Levin Subject: [PATCH 5.19 194/207] i2c: mux: harden i2c_mux_alloc() against integer overflows Date: Mon, 26 Sep 2022 12:13:03 +0200 Message-Id: <20220926100815.281336579@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220926100806.522017616@linuxfoundation.org> References: <20220926100806.522017616@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit b7af938f4379a884f15713319648a7653497a907 ] A couple years back we went through the kernel an automatically converted size calculations to use struct_size() instead. The struct_size() calculation is protected against integer overflows. However it does not make sense to use the result from struct_size() for additional math operations as that would negate any safeness. Fixes: 1f3b69b6b939 ("i2c: mux: Use struct_size() in devm_kzalloc()") Signed-off-by: Dan Carpenter Acked-by: Peter Rosin Reviewed-by: Gustavo A. R. Silva Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin --- drivers/i2c/i2c-mux.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c index 774507b54b57..313904be5f3b 100644 --- a/drivers/i2c/i2c-mux.c +++ b/drivers/i2c/i2c-mux.c @@ -243,9 +243,10 @@ struct i2c_mux_core *i2c_mux_alloc(struct i2c_adapter = *parent, int (*deselect)(struct i2c_mux_core *, u32)) { struct i2c_mux_core *muxc; + size_t mux_size; =20 - muxc =3D devm_kzalloc(dev, struct_size(muxc, adapter, max_adapters) - + sizeof_priv, GFP_KERNEL); + mux_size =3D struct_size(muxc, adapter, max_adapters); + muxc =3D devm_kzalloc(dev, size_add(mux_size, sizeof_priv), GFP_KERNEL); if (!muxc) return NULL; if (sizeof_priv) --=20 2.35.1