scsi: advansys: Prefer struct_size() over open-coded arithmetic
authorLen Baker <len.baker@gmx.com>
Sat, 25 Sep 2021 11:42:05 +0000 (13:42 +0200)
committerMartin K. Petersen <martin.petersen@oracle.com>
Wed, 29 Sep 2021 02:54:55 +0000 (22:54 -0400)
commit568778f5572afd5b30984edd2a4a2c96df8b2b16
treeabce9bbfc180de3ee3dca6f703303f77b751696b
parentce580e47e8481047faf296757d747e95464ff71c
scsi: advansys: Prefer struct_size() over open-coded arithmetic

As noted in the "Deprecated Interfaces, Language Features, Attributes, and
Conventions" documentation [1], size calculations (especially
multiplication) should not be performed in memory allocator (or similar)
function arguments due to the risk of them overflowing. This could lead to
values wrapping around and a smaller allocation being made than the caller
was expecting. Using those allocations could lead to linear overflows of
heap memory and other misbehaviors.

Use the struct_size() helper to do the arithmetic instead of the argument
"size + count * size" in the kzalloc() function.

This code was detected with the help of Coccinelle and audited and fixed
manually.

[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments

Link: https://lore.kernel.org/r/20210925114205.11377-1-len.baker@gmx.com
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Len Baker <len.baker@gmx.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/advansys.c