moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

relay: fix type mismatch when allocating memory in relay_create_buf()

Browse Source 
[ Upstream commit 4d8586e04602fe42f0a782d2005956f8b6302678 ]

The 'padding' field of the 'rchan_buf' structure is an array of 'size_t'
elements, but the memory is allocated for an array of 'size_t *' elements.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Link: https://lkml.kernel.org/r/20221129092002.3538384-1-Ilia.Gavrilov@infotecs.ru
Fixes: b86ff981a8 ("[PATCH] relay: migrate from relayfs to a generic relay API")
Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: wuchi <wuchi.zero@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Gavrilov Ilia
2022-11-29 09:23:38 +00:00
committed by Greg Kroah-Hartman
parent 0d60b11f8f
commit 90962b3b1c
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
kernel/relay.c
View File

@@ -151,13 +151,13 @@ static struct rchan_buf *relay_create_buf(struct rchan *chan)
{ {
struct rchan_buf *buf; struct rchan_buf *buf;
if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t *)) if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t))
return NULL; return NULL;
buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL); buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
if (!buf) if (!buf)
return NULL; return NULL;
buf->padding = kmalloc_array(chan->n_subbufs, sizeof(size_t *), buf->padding = kmalloc_array(chan->n_subbufs, sizeof(size_t),
GFP_KERNEL); GFP_KERNEL);
if (!buf->padding) if (!buf->padding)
goto free_buf; goto free_buf;