Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 27 Sep 2022 09:23:17 -0700
From:   Ira Weiny <ira.weiny@intel.com>
To:     Yu Zhe <yuzhe@nfschina.com>
CC:     "Schofield, Alison" <alison.schofield@intel.com>,
        "Verma, Vishal L" <vishal.l.verma@intel.com>,
        "bwidawsk@kernel.org" <bwidawsk@kernel.org>,
        "Williams, Dan J" <dan.j.williams@intel.com>,
        "linux-cxl@vger.kernel.org" <linux-cxl@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "liqiong@nfschina.com" <liqiong@nfschina.com>,
        "kernel-janitors@vger.kernel.org" <kernel-janitors@vger.kernel.org>
Subject: Re: [PATCH] cxl/pmem: Use size_add() against integer overflow
Message-ID: <YzMjdXArM28bDsQf@iweiny-desk3>
References: <20220927070247.23148-1-yuzhe@nfschina.com>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20220927070247.23148-1-yuzhe@nfschina.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?kxdGXckfB20vpvo9LMbmkpbp6LyzZMa9crVmlxjQqFZNsaQM41KQeLE/o+bJ?=
 =?us-ascii?Q?aTqTOAVkhDO2VGgLqS/Rc2RMY46eE8tLFoTxyJdrrVdt81WZjSi8LfM5e9Q7?=
 =?us-ascii?Q?VJmfCFEdf6+rau0CK8wsLfcNrLNW1G2VnbNUnnlV9cNpmNZ0T6VsDoAfizIN?=
 =?us-ascii?Q?bAJ06H3v4GEIUaHuoQO/TIi1BYfLY82O92O0BhfOZj9GmlPll+BzGUY0R4pt?=
 =?us-ascii?Q?5Su5E31Ywkhkptjltr1a8o8qI+lh+qj0baHo54XUu66K2xeCR9TA564Pu5wy?=
 =?us-ascii?Q?Bcbo4jt9QXGywp2dcQih6kTQaCszHPCYxkXKu95tjGzfxlPKzyMeZsmGOpmI?=
 =?us-ascii?Q?otEGCf00CrNrYv026tlh1q6qgis1w5qtAKPza/YvQ/3xgv0BRvqpiC7mTvHw?=
 =?us-ascii?Q?JlzpFtppVAr3HxUsc2aPx/kRTXOYO8hnaUTlvenYagBe5IaQ5pRutTuQHpKO?=
 =?us-ascii?Q?++dQjW3X8EpFiGpfRr+o1d0RuXnNyEsvOJCwB5PItcuZ/kOO+MxYOdgMBt+x?=
 =?us-ascii?Q?tNzgQQhyAwCgcb3smlm334b971gdlK+iDxOWcS4jdZNrf4Xkp/kAO0xQzhTO?=
 =?us-ascii?Q?fpCMsbGDguE9D37/VPxlkMVmt89BaU8tCEmzMDrkehHmT5Ze9byzTySRBI0k?=
 =?us-ascii?Q?OPXAGLbXRD5C97COpHb45++pqSDbb/Ngx2nIywX8svTv7mOxMN7DqZO1i4qr?=
 =?us-ascii?Q?t/G0nkq8cPWOQZ1hEZCDEX4Wj0SNRS032sjRaZ7yLDccvVSlyVcPtN+7mBTW?=
 =?us-ascii?Q?fUyDI2iKJegZ/nxT3WM0EO7Bk+XBG2aZAoEThwNZGUIUX9R6+sh0iTgVB2Y5?=
 =?us-ascii?Q?WxCYicCDUOQU88AIoWIgjTfViQZ9bgpsSHD3JR+n9NTn9OifsqHSh0AVa9eJ?=
 =?us-ascii?Q?LLg4JYLKZ8MF9TIZKYyKpODeCJs6D3SGZaBBuw8xDdWn1XquBzmnveQv4Evq?=
 =?us-ascii?Q?N9GtiVaUjR0jdm33Qrcm7F9snFSOoOsmdHGUMQYZAZ7evEqkiX0uagQExKa0?=
 =?us-ascii?Q?smEHl+U2QoysyxmPMOL+tqTabWYAueYZa5J7zOMPDJBfJPr5YSsgbh6365Ij?=
 =?us-ascii?Q?zTu/7EwdxHIxgod9eg4z32UFQ5FgGWppgRP3zJC6DrlDbBYVL6YA8BGdnxxc?=
 =?us-ascii?Q?ejlL+6TM1AGACgkY1bRc7bnePX5d4hc9hwtEGSDapXDYDdSMyV59PlhGAkE/?=
 =?us-ascii?Q?M4lBypOTYvETWO2St/1Px2nmwwu4nrM0MfGoNSc6cI3wQ/5/a5HfBy2WFXhx?=
 =?us-ascii?Q?4Q0rnvA4BEzuQfOU1tFPsegRJrAjbDhCQqF9pu/5gwlp31QFs/tACp7WaZYD?=
 =?us-ascii?Q?CCgEe9XYx13DhC0g3TSZxtQFejyUdGDHce/49PXMS1Ra8UMKxyPA/jcBKQG/?=
 =?us-ascii?Q?KjFpJJfa1VA6pfxkTHCHdj8vOGv0IcdZrmVz1MO7U1SvhlhBnuhGmb3YeDBM?=
 =?us-ascii?Q?waonAyk4YbU3/26w5ywQh0qHL1Wn6MbaoQgVwKY8GZq7mBHbfCa0cDokKT4a?=
 =?us-ascii?Q?Bi/csCPKvnjQ878ma7G/E0fSxPIOa+xlVrREMS1h01BStPwf9+DGJgk30wLz?=
 =?us-ascii?Q?G4/g/gP6dOi8JEjfW/Te1LIjflOVx5LQTvTgvYS0LsCzinDwsi9VUuvP7MZL?=
 =?us-ascii?Q?CA=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: f6aa4f4b-0720-4e6d-eb53-08daa0a497b2
X-MS-Exchange-CrossTenant-AuthSource: SA1PR11MB6733.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Sep 2022 16:23:20.7594
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: +omH8SIeZjnkJR4VqoKyA57iaBDCE16EHrg99u5NLpmWLvihKNvBI6K3y/nGhqN5ycT/P8vMeN1plxHWRsP9yQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR11MB7076
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-4.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,
        SPF_HELO_PASS,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Sep 27, 2022 at 12:02:47AM -0700, Yu Zhe wrote:
> "struct_size() + n" may cause a integer overflow,
> use size_add() to handle it.
> 
> Signed-off-by: Yu Zhe <yuzhe@nfschina.com>
> ---
>  drivers/cxl/pmem.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/cxl/pmem.c b/drivers/cxl/pmem.c
> index 7dc0a2fa1a6b..8c08aa009a56 100644
> --- a/drivers/cxl/pmem.c
> +++ b/drivers/cxl/pmem.c
> @@ -148,7 +148,7 @@ static int cxl_pmem_set_config_data(struct cxl_dev_state *cxlds,
>  		return -EINVAL;
>  
>  	/* 4-byte status follows the input data in the payload */
> -	if (struct_size(cmd, in_buf, cmd->in_length) + 4 > buf_len)
> +	if (size_add(struct_size(cmd, in_buf, cmd->in_length), 4) > buf_len)

I don't see any benefit here.

struct_size() calls __ab_c_size() which already calls check_add_overflow()?  So
why wrap that in another check?

Were you able to get this to fail with some user input?

Ira

>  		return -EINVAL;
>  
>  	set_lsa =
> -- 
> 2.11.0
>