Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 16 Sep 2022 11:20:08 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Kees Cook <keescook@chromium.org>
Cc:     Peter Rosin <peda@axentia.se>, Wolfram Sang <wsa@kernel.org>,
        "Gustavo A. R. Silva" <gustavo@embeddedor.com>,
        linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org,
        kernel-janitors@vger.kernel.org
Subject: Re: [PATCH] i2c: mux: harden i2c_mux_alloc() against integer
 overflows
Message-ID: <YyQxuHi2iQIvj0Lj@kadam>
References: <YyMM8iVSHJ4ammsg@kili>
 <202209160046.016AC8B4@keescook>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <202209160046.016AC8B4@keescook>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?LR8s1aS59iiMjy7ouaGeZ02Y85tMkBLlA7iuK3dJwbTfl9BS2gU8GDfMzqPN?=
 =?us-ascii?Q?lZuYL6BdHvAZMoMjsWe7wBGkSR6XB7+NpsygvytxsQ6C9cCfEXpZEbGeg/QV?=
 =?us-ascii?Q?TfapsQ7XmnrDDPFqVkN6le/oPZRQdxkaxun9IN4fxDO6pjKwy/eJWVPeO4o9?=
 =?us-ascii?Q?2XGiLPnXtAd9Lz5a5Lo79UnZgXp1oN4jHAboFCkXmYbJ2nT1zwRGl3GSkI6E?=
 =?us-ascii?Q?u8mZb1VzoOQqMfF4XMYFVugs6T99k3UvuJJkYo0hMrPmzgB43G2PGU7HmYEh?=
 =?us-ascii?Q?cyYm2GqN2qEhj9DXiN/asWwSnpot6BSz71Iajv0fjUE7+JLDYmcRhhPxdvtF?=
 =?us-ascii?Q?VX9Il96dEz5C7VxvBT1xFTrqYkWysMTLGVG1nDcuutZA9svHww0M+05pnaOa?=
 =?us-ascii?Q?JFvnT0VUkljd1i8pckyOUlCGmlwVpIJDCqzSvRyb2J3DVVVh6wHfnGAmNSdr?=
 =?us-ascii?Q?NaHEAILkJzXS4LFaJ8NTN3IYMP8WHM9umjL/IpN4K2KnDdZQZjx++Yak136z?=
 =?us-ascii?Q?wpHyb+/JZLOSTqGK0rJV4gKG9lhTMn43iEAT1IwVLKvL9a9CHdUlkgT1+LAn?=
 =?us-ascii?Q?MAyV2DKBrM77fOpb/+NcKRj6hAG4PDVoRiIYGdn7XEhyJChhjOOeywCH0XSF?=
 =?us-ascii?Q?wXgIwa/jTsN9nmBLTj04MNwMy0Rwvoo7OyLl29yVe35eIw35VtGwe66HBqnL?=
 =?us-ascii?Q?lD/epmyNfp37PIKItbH3mWVRoAIKOzajrVWnG588et9vDmN1AnaZWxev/lom?=
 =?us-ascii?Q?inhMr78qgYtp+iNc3CTlilSJWX+OhhPlDDO9+Oz+hcNv5UR3hsw0JMtBO+o+?=
 =?us-ascii?Q?jPpi8Ha+f8klxPfkDwcxPy4W8juTLwVHYZnDrOtEBydI4FQvOYTcwAjCEAgm?=
 =?us-ascii?Q?K+7p6kJmHhkJs8Xa8o+lB7Fkg9MHrhkubPugSm3UdB9nlO4UYPhX9NvZTlK0?=
 =?us-ascii?Q?Cxig17SyNp9Snbkw2eosj++/kWW8G1D49K5g0yQevdPWAlQpnBtqIZg7Ecu9?=
 =?us-ascii?Q?/WX4VdOfWg6i1okPK4j40N8+QuXSmZ8D1rZyCUrnnnbgTPAYnRaD5NGcuX8i?=
 =?us-ascii?Q?c+rOOSjCwV4MUfsvblKWyaaaZKcnYyw9+xsnYaDmTunf39HJTNnVZGrnIhkS?=
 =?us-ascii?Q?LwMiGhjA/ABhcbZIFRam4xTP1lIGX6H6hJydG7OiBxx0lR8CVM+3s2tyEv3V?=
 =?us-ascii?Q?iRmwcKNPrPwPCt6Z6PXkRIaS1Kvy7D250a+3vf2xZMuLwS9vO1N+YYDrujLi?=
 =?us-ascii?Q?wunpmniJEYMZSP5G5PnVly80ddVjhBXf8Ix3g3iE1XBEWh4Yhoqi+h92wdoq?=
 =?us-ascii?Q?nFMO3n0q+nYz9lEIiah6oRMxkxeHTBiMLLA80+KAsCNFy2OTCaAckZRiMJ2t?=
 =?us-ascii?Q?9kCZ7LX0QQWn6TbCe540nCdWYqprxDCVHKgqciELODYPFCnaw1Pzlx0XDhmU?=
 =?us-ascii?Q?iL4n23OFP/q+K3/5rE6ExF0MNQP3rJXN4Eclo97cPisVxA9JDROVrv3bXIkw?=
 =?us-ascii?Q?M8LTTi91plMQRkmLauV9EKVaF4rMMaSMAbRTG5TcmAkxlM2zkv+p8zZfc1v2?=
 =?us-ascii?Q?gjpL98PSACJxkC9su+XjlTUfXfK30Ryt9Cv0Jicjf4efmHySfnnff3Drcd/Y?=
 =?us-ascii?Q?fA=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 0bd2b380-d01a-4d2b-8057-08da97bc5408
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Sep 2022 08:20:34.7710
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: FeER7G4LjQWn1VudD2u0/9+d5S8QZK51fSlASdteNYnB3A6axrSsSuuXKudhLZbrVQYLwKqWGlK+zs1x4s2YNwXfGAB3+CHRHUdrO2OGgE8=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB6350
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1
 definitions=2022-09-16_04,2022-09-14_04,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 bulkscore=0 phishscore=0
 mlxlogscore=999 suspectscore=0 adultscore=0 spamscore=0 mlxscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2209130000
 definitions=main-2209160060
X-Proofpoint-GUID: QStquy9432BobLd8MXtdfcMBKo0ntEw6
X-Proofpoint-ORIG-GUID: QStquy9432BobLd8MXtdfcMBKo0ntEw6
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Sep 16, 2022 at 01:01:42AM -0700, Kees Cook wrote:
> > diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
> > index 774507b54b57..313904be5f3b 100644
> > --- a/drivers/i2c/i2c-mux.c
> > +++ b/drivers/i2c/i2c-mux.c
> > @@ -243,9 +243,10 @@ struct i2c_mux_core *i2c_mux_alloc(struct i2c_adapter *parent,
> >  				   int (*deselect)(struct i2c_mux_core *, u32))
> >  {
> >  	struct i2c_mux_core *muxc;
> > +	size_t mux_size;
> >  
> > -	muxc = devm_kzalloc(dev, struct_size(muxc, adapter, max_adapters)
> > -			    + sizeof_priv, GFP_KERNEL);
> > +	mux_size = struct_size(muxc, adapter, max_adapters);
> > +	muxc = devm_kzalloc(dev, size_add(mux_size, sizeof_priv), GFP_KERNEL);
> >  	if (!muxc)
> >  		return NULL;
> >  	if (sizeof_priv)
> 
> The new variable makes it more readable, but beyond that, do you see any
> reason not to just directly compose the calls?
> 

You could do that too.

You pointed this out in your other email but the one thing that people
have to be careful of when assigning struct_size() is that the
"mux_size" variable has to be size_t.

The math in submit_create() from drivers/gpu/drm/msm/msm_gem_submit.c
is so terribly unreadable.  It works but it's so ugly.  Unfortunately,
I'm the person who wrote it.

regards,
dan carpenter