Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH][next] net/ipv6/mcast: Use struct_size() helper
To:     "Gustavo A. R. Silva" <gustavoars@kernel.org>,
        "David S. Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>,
        Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
        David Ahern <dsahern@kernel.org>
Cc:     netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-hardening@vger.kernel.org
References: <20210804214352.GA46670@embeddedor>
From:   Eric Dumazet <eric.dumazet@gmail.com>
Message-ID: <aaa77803-fb5f-6444-ae2b-d6498ffea252@gmail.com>
Date:   Thu, 5 Aug 2021 13:00:01 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.11.0
MIME-Version: 1.0
In-Reply-To: <20210804214352.GA46670@embeddedor>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 8/4/21 11:43 PM, Gustavo A. R. Silva wrote:
> Replace IP6_SFLSIZE() with struct_size() helper in order to avoid any
> potential type mistakes or integer overflows that, in the worst
> scenario, could lead to heap overflows.
> 
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> ---
>  include/net/if_inet6.h |  3 ---
>  net/ipv6/mcast.c       | 20 +++++++++++++-------
>  2 files changed, 13 insertions(+), 10 deletions(-)
> 
> diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
> index 71bb4cc4d05d..42235c178b06 100644
> --- a/include/net/if_inet6.h
> +++ b/include/net/if_inet6.h
> @@ -82,9 +82,6 @@ struct ip6_sf_socklist {
>  	struct in6_addr		sl_addr[];
>  };
>  
> -#define IP6_SFLSIZE(count)	(sizeof(struct ip6_sf_socklist) + \
> -	(count) * sizeof(struct in6_addr))
> -
>  #define IP6_SFBLOCK	10	/* allocate this many at once */
>  
>  struct ipv6_mc_socklist {
> diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
> index 54ec163fbafa..cd951faa2fac 100644
> --- a/net/ipv6/mcast.c
> +++ b/net/ipv6/mcast.c
> @@ -447,7 +447,8 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
>  
>  		if (psl)
>  			count += psl->sl_max;
> -		newpsl = sock_kmalloc(sk, IP6_SFLSIZE(count), GFP_KERNEL);
> +		newpsl = sock_kmalloc(sk, struct_size(newpsl, sl_addr, count),
> +				      GFP_KERNEL);


I find the current code is more readable.

Please only change IP6_SFLSIZE() definition maybe