Received: by 2002:ac0:a5b6:0:0:0:0:0 with SMTP id m51-v6csp30143imm; Thu, 31 May 2018 17:48:38 -0700 (PDT) X-Google-Smtp-Source: ADUXVKI04EUb/beFjUcIJA+PDwfz5v0jhC+uSMR1oYrzOv7TDps4wppCza7h6B2ycP1hGXn8/BjA X-Received: by 2002:a63:6e84:: with SMTP id j126-v6mr7180727pgc.239.1527814118896; Thu, 31 May 2018 17:48:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1527814118; cv=none; d=google.com; s=arc-20160816; b=PjMItBeeI6Mm33jd4nE+6eAJ9eKdIZ1impGNQI2yRr1yz/SVjstFDsaRgY5GVHvOyV 2danIWiiypurH1lIw6nj1WutlXz+fxf04JBnmSjGLEZhJhuCP1faOMunyJoB9HhSnfZA DUF+iyFGsePUSqOhgHiIaNBRh+QgfIbhimg9QqOUoHlDG4bYMlC35gGSdSGCRAy0oxYk +WHtYaNA4JCjQ1RH1vT0HxYa0OCmXfHFB2WcXuzcyZVinTUKCjVjoQLYDWGe8AV6jxb8 8EV32vRU+tVgtOXoqU7up+Abzm4ED/0LomuJQ90wcyaYbfJoqp3jFYqBq57T0eC09DFU em4A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=7XKqD0uwptRTWTsv7lmAcV/cMTd4waW5o5MaWTUpnRc=; b=tXcot14SjChdcGFHYx2vTynZgS9gM/EH/w57raHLyWwfE1/djOlQzSu5T9mBw9nGIc NWtQXGHhkHTCdZwKhknwtlsSaUkv7mqaYXeb2me30+QQefO5ZHQzQXsU44qTDC7bffZv atWzENNLksIOsjM18Si38BWsbxAv6ycKXey3r+FTZie8VchLz27xZIv5/Hr4JnEd89fw s/jNsBxa9CzOvqwBYJJtdN7LdUueirFZqGuSOzT/L/NfGFa8M5W81eVpX68Wij+0o2Ib qlKOOUKqyS+6qHSs1Kby/XAF/Fi1l6fOL/eG5CzQP81igbbqJNrroSW7KboPTxP2fwLH I7yA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=k+ROhkPj; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id u17-v6si30166818pgv.17.2018.05.31.17.48.24; Thu, 31 May 2018 17:48:38 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=k+ROhkPj; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751759AbeFAAqH (ORCPT + 99 others); Thu, 31 May 2018 20:46:07 -0400 Received: from mail-pg0-f68.google.com ([74.125.83.68]:38960 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751411AbeFAAnt (ORCPT ); Thu, 31 May 2018 20:43:49 -0400 Received: by mail-pg0-f68.google.com with SMTP id w12-v6so9244016pgc.6 for ; Thu, 31 May 2018 17:43:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=7XKqD0uwptRTWTsv7lmAcV/cMTd4waW5o5MaWTUpnRc=; b=k+ROhkPj4yqwXzrpj5XXCx+1cCW3riU2WUCBTey2JW0RKCk13UnwxNldvienBOMZIX 42n9Am2s7LoM/fBRp2UtOymC6coonvsOpI17OvSnv7vPkKdxFbJl+cB7vxck3mRfZa/N jFDvFgq60fOdVgQGuOFqyHDAKuAnL054qoQoc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=7XKqD0uwptRTWTsv7lmAcV/cMTd4waW5o5MaWTUpnRc=; b=HsJz3kdxr/Ac5w2/pWqsZt3eWHiWlpOf9oEq91CSHgT4EB0cmkKGLX7w5FruijP7Pr AO7ALMwi1cz9JViNyRR/HYM/SfDXRPj0uQVVPoDwjmoJrZW3GT7fvODov9ow3BE4wBoF tk7f34pGRVFNByOGFwlQxd6c/j/I5poW+xrKyr6m3bzWXSEoG5X6tWXM+y+2IFjvO8xo clPHvG96hfgTiHzczZxwLeVDTgyCYxoeG9XZedeW6Qpvwhj2KjOJHrNJMBoexMxH0/hg QzGW46gOHi41RmUUZNpk5X4iVFuNzGR5UFFxX8Qnu6Y7/vsohQiXOIVL82hXT6R9xV00 316w== X-Gm-Message-State: ALKqPwfpQoc1nx4NS41TRAUkvGmZ3QtNyGhJdMaOCyeSZ4RHhxOrExOG HMluZQRSdJAl/s3Nva2jMfZsAQ== X-Received: by 2002:a62:ab0e:: with SMTP id p14-v6mr3114266pff.211.1527813829443; Thu, 31 May 2018 17:43:49 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id x4-v6sm65267683pfb.99.2018.05.31.17.43.43 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Thu, 31 May 2018 17:43:45 -0700 (PDT) From: Kees Cook To: Matthew Wilcox Cc: Kees Cook , Linus Torvalds , Rasmus Villemoes , Matthew Wilcox , LKML , Linux-MM , Kernel Hardening Subject: [PATCH v3 08/16] device: Use overflow helpers for devm_kmalloc() Date: Thu, 31 May 2018 17:42:25 -0700 Message-Id: <20180601004233.37822-9-keescook@chromium.org> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180601004233.37822-1-keescook@chromium.org> References: <20180601004233.37822-1-keescook@chromium.org> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Use the overflow helpers both in existing multiplication-using inlines as well as the addition-overflow case in the core allocation routine. Signed-off-by: Kees Cook --- drivers/base/devres.c | 7 ++++++- include/linux/device.h | 8 ++++++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/base/devres.c b/drivers/base/devres.c index 95b67281cd2a..f98a097e73f2 100644 --- a/drivers/base/devres.c +++ b/drivers/base/devres.c @@ -84,9 +84,14 @@ static struct devres_group * node_to_group(struct devres_node *node) static __always_inline struct devres * alloc_dr(dr_release_t release, size_t size, gfp_t gfp, int nid) { - size_t tot_size = sizeof(struct devres) + size; + size_t tot_size; struct devres *dr; + /* We must catch any near-SIZE_MAX cases that could overflow. */ + if (unlikely(check_add_overflow(sizeof(struct devres), size, + &tot_size))) + return NULL; + dr = kmalloc_node_track_caller(tot_size, gfp, nid); if (unlikely(!dr)) return NULL; diff --git a/include/linux/device.h b/include/linux/device.h index 477956990f5e..897efa647203 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -25,6 +25,7 @@ #include #include #include +#include #include struct device; @@ -668,9 +669,12 @@ static inline void *devm_kzalloc(struct device *dev, size_t size, gfp_t gfp) static inline void *devm_kmalloc_array(struct device *dev, size_t n, size_t size, gfp_t flags) { - if (size != 0 && n > SIZE_MAX / size) + size_t bytes; + + if (unlikely(check_mul_overflow(n, size, &bytes))) return NULL; - return devm_kmalloc(dev, n * size, flags); + + return devm_kmalloc(dev, bytes, flags); } static inline void *devm_kcalloc(struct device *dev, size_t n, size_t size, gfp_t flags) -- 2.17.0