Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 21 Oct 2022 16:07:00 -0700
From:   Dan Williams <dan.j.williams@intel.com>
To:     Yu Zhe <yuzhe@nfschina.com>, <alison.schofield@intel.com>,
        <vishal.l.verma@intel.com>, <ira.weiny@intel.com>,
        <bwidawsk@kernel.org>, <dan.j.williams@intel.com>
CC:     <linux-cxl@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
        <liqiong@nfschina.com>, <kernel-janitors@vger.kernel.org>,
        Yu Zhe <yuzhe@nfschina.com>
Subject: RE: [PATCH] cxl/pmem: Use size_add() against integer overflow
Message-ID: <635326141b6d9_4da3294cd@dwillia2-xfh.jf.intel.com.notmuch>
References: <20220927070247.23148-1-yuzhe@nfschina.com>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20220927070247.23148-1-yuzhe@nfschina.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?eU2DEDMzXxa1p92Vz9Hrqv2GNbuSPd+tCRNFJ14Ok2HoFhzbAiXCXOktRyYn?=
 =?us-ascii?Q?QghbeF/Hy9QlawbA18l0szP7Zq5WuuZaCXNmvl4G+POVh46+a/Q0Xo4/ngVN?=
 =?us-ascii?Q?L/AIodypLEDyPzKLqv8SzwvILT4j88JBD3m8/ItR835jf+mZiaSSIWmEcWe0?=
 =?us-ascii?Q?QfiSjWIRtK9vI5hYSZXDppJrkPOK+LHOJCJ0Z7s1jxwKAGLVHNoLHhcOPGux?=
 =?us-ascii?Q?YSyluWUlmWomSx9PpoF9ckvjtfSI9FrmyC3czStAGVpkBWwCFo2mNvLXmVMT?=
 =?us-ascii?Q?nMI22LzVg89rYMCGngPDq8Bqeau+SaQEnz108C6iGlJ5Lf9o8ZgVp65rP+X4?=
 =?us-ascii?Q?wkwmOgAnY0I3mIvKHos+DKY1X1Bu7noPBOcBmwS78MyIfMB2Ve5COHHthYKd?=
 =?us-ascii?Q?nK+hrjP/45eCBA1zJjQaskAJCeRLTN008pop14O/UJP+B/jvSJFmHdG1Ia0b?=
 =?us-ascii?Q?d9T6nCwYlHyNefFvPcBw1B/c1RUihuCh2+2Ttumj45tGPhktkjg4pRsWyvC3?=
 =?us-ascii?Q?KGNVy4qC6mLuKjCauS0kvPGU+ZkjFP6lMQvpDi+YcUP8ewAXmQg0Qeyte2t4?=
 =?us-ascii?Q?zrL2Rrcr8QlxkN+fkZiNaO0OQvFMuJzVRGANJYiYr0w2wRto2LCFkT+6S6e8?=
 =?us-ascii?Q?YV7uCF8J8Lny8C8HNPmsoYF/GMCdETa1KWsdOvNH7f1zbfjYtcj4aVyQ2NpA?=
 =?us-ascii?Q?usbXj16eDjjAE1RA/BVTp0c7pmWRoWVsxi8f3p2qRZDQ7bXoz0BVHxmLqevg?=
 =?us-ascii?Q?6fpNnljo2LhUtf/xlacK94ASbkh7nEHx6Uppzlc4xsd/eIrfySpFvvy1FfdP?=
 =?us-ascii?Q?BgUgyJD2bTSi57rIZjlVzxvk6RHyOPXMNt6Cv3IHHoy+M7Ow5iS02nTLuq6x?=
 =?us-ascii?Q?83zMYwQXr/Wade0EsC02Mjtmo0uDypjXfG050hlvFkn0XcIne33JwHTuCDBf?=
 =?us-ascii?Q?qpOLx83FOPABQYaosMG03/63Hdq8kZDSV0nIDDOpYHz0Zyu8cnB1zakfQ1dA?=
 =?us-ascii?Q?rgEuTC36yZnMLy5m92GLhuBQn6T7TPnoir+TFBNEQLA/S6AMzzX4gXTNJQ+c?=
 =?us-ascii?Q?LYMTa2i8p/k7ZU2Gij4C5bycisDaONSfErQE8NJ9L0LTRzAHqLJPuAe4IZDM?=
 =?us-ascii?Q?7Vp9JXC0EvcHOdSP6BEWR/rcaOhDP6BoVM+UQLT9gv4fH/mPZoNZENFkLkXo?=
 =?us-ascii?Q?imElCy4iMp5es14rAso/ggR7TA+bmrruvJbD+LEKVBw+Su5xTmBuabVYgq0r?=
 =?us-ascii?Q?xMnQDLAudjfOb912Xfn83dWzbEHSw50IdVAvf8VQHQ4DS94iExELTIlu6A13?=
 =?us-ascii?Q?fx62WT8Y6GFGAiSiapaVNcitn3MIAmLj20aRp2Bk174CUFKjV/MolDF0kt5S?=
 =?us-ascii?Q?27tiey/fS81Z2vzbJUHvQydgf9dnxuQEq9tl+DWw5ucQ485a1EMA7fDcBBh7?=
 =?us-ascii?Q?Tc/d5lgNLpkUhDNbQVjeewkKhXfVyMpwMc/7avSlViVwibVDyY0ReI4/sRRF?=
 =?us-ascii?Q?ZsFe8m/nFzEkcmZX+u5FfoQ8sH+TS/I+h9n5nPQzo9eGjSeaIVfZasuroN23?=
 =?us-ascii?Q?LknvBDHRwR76LcVCOZfQw2Pi0kRr/XnU7tATtninxwtOCfB78VYqsMwyc8Ns?=
 =?us-ascii?Q?Tg=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 373d3596-1fd6-465b-ec06-08dab3b8f6e6
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1101MB2126.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Oct 2022 23:07:02.5904
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: MS1NNMqCfmaJDWGocvAkk9uCHhjjdnjGuYuNGKotdNMQ8X3VJ97aqFcpaOHK7fmtDjVvRbH4ZJw55LmfG+lkrKIeI/J9OR5m3AIj5OPPss8=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR11MB5583
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-4.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,
        SPF_HELO_NONE,SPF_NONE,URIBL_BLOCKED autolearn=ham autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Yu Zhe wrote:
> "struct_size() + n" may cause a integer overflow,
> use size_add() to handle it.
> 
> Signed-off-by: Yu Zhe <yuzhe@nfschina.com>
> ---
>  drivers/cxl/pmem.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/cxl/pmem.c b/drivers/cxl/pmem.c
> index 7dc0a2fa1a6b..8c08aa009a56 100644
> --- a/drivers/cxl/pmem.c
> +++ b/drivers/cxl/pmem.c
> @@ -148,7 +148,7 @@ static int cxl_pmem_set_config_data(struct cxl_dev_state *cxlds,
>  		return -EINVAL;
>  
>  	/* 4-byte status follows the input data in the payload */
> -	if (struct_size(cmd, in_buf, cmd->in_length) + 4 > buf_len)
> +	if (size_add(struct_size(cmd, in_buf, cmd->in_length), 4) > buf_len)
>  		return -EINVAL;

Looks good, applied for v6.1-rc fixes.