Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 15 Sep 2022 14:30:58 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Peter Rosin <peda@axentia.se>
Cc:     Wolfram Sang <wsa@kernel.org>,
        "Gustavo A. R. Silva" <gustavo@embeddedor.com>,
        linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org,
        kernel-janitors@vger.kernel.org
Subject: [PATCH] i2c: mux: harden i2c_mux_alloc() against integer overflows
Message-ID: <YyMM8iVSHJ4ammsg@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?rGLP/stdEDUn+cndcm/abh6MPdY9XrdBw+lhCrTJbVNDPgw1l4kqHQt4h7jy?=
 =?us-ascii?Q?QYAGsv+THcHlVNx6m7vP9JoVrsLegddsLHnru9fLYDSsFrM6hboUDPX9paNe?=
 =?us-ascii?Q?7n5aZSZt/QfemdaDleZqlNv+PPxTRsQ+fYmRQO8old9odoErPuzrZGiCQMO/?=
 =?us-ascii?Q?9E7kXmTnxlXQ449xyiRvzQkJooALMAt5PaZ/M1yRY4tWXMexI3RvnzqWiIbW?=
 =?us-ascii?Q?FFj1+BbOZbD7U1E2Yqv/0MeoYjiZParvRwcBkjFWmHLk9ntq9FXgDI/TMToK?=
 =?us-ascii?Q?WcOv1rwnXIHr4pcMvBBppWsYK7noE2mdTH/HYGBTnY5J0oVYvgxy95PurN+H?=
 =?us-ascii?Q?MO5YFs/5m1IivJNzvhTC0F0XrGhgSgSVLEIrmW7OuKK0We2QGjXUmi6iLEwu?=
 =?us-ascii?Q?oUDkUMAaOgWgWn4Lsdiq2+CNhfYbPCVwWAuVEY+pP0cXxlFzWNCwsX9Y0udL?=
 =?us-ascii?Q?ckzDHjSVcqnAFhVSaBnHI/lyyEzksMtMegriWpehz2UNSFycUZjWrbqZ6fjk?=
 =?us-ascii?Q?KLQxSCTs6CvFwEn+/nFrxcc/VUhusNSl68DkA04HnEZ6rdwTa7E9MOGR0Ryk?=
 =?us-ascii?Q?nEJxwFV7ORN1xUNbt115jvvIh6FtWp8f1Ub4fMI8ScnLg//hKzyqLy4IOAtw?=
 =?us-ascii?Q?hR0tOSYo1HaxYgtQ3T6wDnCJX4ujJmqctzVTOV0558pysdZJt6ogIVVf2Arz?=
 =?us-ascii?Q?ZxAATY9vQfK5/xaIGRokZa5OrlInuRyioLygnHJ15zJP989AKRrR4PzerfNL?=
 =?us-ascii?Q?P8/7ahnFSpDCHNZOIiWtl0RaTVWnlKYbBqLrAi+CSkEjwEByd5nXVXUcyj3v?=
 =?us-ascii?Q?2BdC8iFZsTzoK/VEZeZiRbcmD0FCUE2M1lP+9G4OgnHL5Q9IFe5S1mRHVqF+?=
 =?us-ascii?Q?t8PJ5OkyMorUsWjOENA9Uok1KD6cwYHdFNxTvj5brq2AgHTB10suWSmxpxWS?=
 =?us-ascii?Q?Wcrx6XNW5chLxZx33QtxtM+ZJ/uNHPcj3wMZbBVj6Cc+pch/1FYz6JU77ymb?=
 =?us-ascii?Q?oMZWgftRIouK98dUNj655ryc23OdFxDj1v8tuI9qSoMrRjCMfrASGIgKKCIL?=
 =?us-ascii?Q?CquSUIizw6//UVx5ERgZ2dJgeVvJ4jTWnttIFevIcNiuDGzcW1ViGR/Ncde6?=
 =?us-ascii?Q?3qYCT+QarrnKE3fkPGFi/z949pDXVLlWH/T62JBCFBRF8E8W0rnL2jFg6G/K?=
 =?us-ascii?Q?fhdMjJOCfBAV7Y/rvqpj/TI6J1Cnr6UmHwN+RiWfMaGmISjapbLdEFw3f3jj?=
 =?us-ascii?Q?EIFjWc4D8+K5wAmlJ5bYil5T/heNirx6Ojn4vE4EpyuqG70IKVscOtWTEgn2?=
 =?us-ascii?Q?oWcBbvGVBCwWkln+TEJB0VHCjtKy5aT1bGqYgnD1ZvoS04ZAcgU5XByhJQeO?=
 =?us-ascii?Q?a6PFRJm+51HwhM47B4Dw6gEfu9GsY6g7u+sgY0DqWgLN90CrFNapxc9T74zf?=
 =?us-ascii?Q?g4aZbd+44lo+DcuUMr5CD2oTNFhECJmQJjHgQ/RIZbVYENnGhWDt11Nucj/w?=
 =?us-ascii?Q?EP1ivdqtPGlgs/TGPlvcgDxmGcmUxos2FmdGc/mAcI7JIwUHV2ruHGjBcnSd?=
 =?us-ascii?Q?UTrel9bCJx5WdqHpPuIlfuQu4eGrbWNpKT0S0hoBtQvryBiCzrmgI10k+cee?=
 =?us-ascii?Q?EQ=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d1893769-611a-44f1-5f86-08da970dc6ab
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Sep 2022 11:31:05.1085
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: NF7YC5kStTEJTsDWyY3ocGLH1fmuyyU6JxwtH3Zam5czcAZYRe5fxnWe9bQ1RvJ7kSNAxQU7ADU+lpUak5sYHv/WzT9AniWcMM/quWagOE0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB5707
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1
 definitions=2022-09-15_06,2022-09-14_04,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 spamscore=0 adultscore=0
 malwarescore=0 suspectscore=0 bulkscore=0 mlxlogscore=999 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2208220000
 definitions=main-2209150064
X-Proofpoint-GUID: 1FtHd-3_0eJYiQGsH6BsvS_sfkZMSzkP
X-Proofpoint-ORIG-GUID: 1FtHd-3_0eJYiQGsH6BsvS_sfkZMSzkP
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

A couple years back we went through the kernel an automatically
converted size calculations to use struct_size() instead.  The
struct_size() calculation is protected against integer overflows.

However it does not make sense to use the result from struct_size()
for additional math operations as that would negate any safeness.

Fixes: 1f3b69b6b939 ("i2c: mux: Use struct_size() in devm_kzalloc()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/i2c/i2c-mux.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
index 774507b54b57..313904be5f3b 100644
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -243,9 +243,10 @@ struct i2c_mux_core *i2c_mux_alloc(struct i2c_adapter *parent,
 				   int (*deselect)(struct i2c_mux_core *, u32))
 {
 	struct i2c_mux_core *muxc;
+	size_t mux_size;
 
-	muxc = devm_kzalloc(dev, struct_size(muxc, adapter, max_adapters)
-			    + sizeof_priv, GFP_KERNEL);
+	mux_size = struct_size(muxc, adapter, max_adapters);
+	muxc = devm_kzalloc(dev, size_add(mux_size, sizeof_priv), GFP_KERNEL);
 	if (!muxc)
 		return NULL;
 	if (sizeof_priv)
-- 
2.35.1