[PATCH][next] scsi: storvsc: Use struct_size() helper in storvsc_queuecommand()
From: Gustavo A. R. Silva
Date: Tue Jan 25 2022 - 14:36:20 EST
Make use of the struct_size() helper instead of an open-coded version,
in order to avoid any potential type mistakes or integer overflows that,
in the worst scenario, could lead to heap overflows.
Also, address the following sparse warnings:
drivers/scsi/storvsc_drv.c:1843:39: warning: using sizeof on a flexible structure
Link: https://github.com/KSPP/linux/issues/174
Signed-off-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx>
---
drivers/scsi/storvsc_drv.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 9a0bba5a51a7..89c20dfc6609 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1755,7 +1755,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
struct scatterlist *sgl;
struct vmscsi_request *vm_srb;
struct vmbus_packet_mpb_array *payload;
- u32 payload_sz;
+ size_t payload_sz;
u32 length;
if (vmstor_proto_version <= VMSTOR_PROTO_VERSION_WIN8) {
@@ -1839,8 +1839,8 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
if (hvpg_count > MAX_PAGE_BUFFER_COUNT) {
- payload_sz = (hvpg_count * sizeof(u64) +
- sizeof(struct vmbus_packet_mpb_array));
+ payload_sz = struct_size(payload, range.pfn_array,
+ hvpg_count);
payload = kzalloc(payload_sz, GFP_ATOMIC);
if (!payload)
return SCSI_MLQUEUE_DEVICE_BUSY;
--
2.27.0