Commit 92527e47 authored by Elizabeth Figura's avatar Elizabeth Figura Committed by Greg Kroah-Hartman
Browse files

ntsync: Check wait count based on byte size. 



GCC versions below 13 incorrectly detect the copy size as being static and too
small to fit in the "fds" array. Work around this by explicitly calculating the
size and returning EINVAL based on that, instead of based on the object count.

Reported-by: default avatarkernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202502072019.LYoCR9bF-lkp@intel.com/


Suggested-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarElizabeth Figura <zfigura@codeweavers.com>

--

Suggested-by as per Arnd's request, but the only thing I changed was preserving
array_size() [as noted by Geert in the linked thread]. I tested and found no
regressions.

v2: Add missing sign-off
Link: https://lore.kernel.org/r/20250220192334.549167-1-zfigura@codeweavers.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 32ce5d87

drivers/misc/ntsync.c

+3 −3
Original line number Diff line number Diff line
@@ -873,6 +873,7 @@ static int setup_wait(struct ntsync_device *dev, 
{

	int fds[NTSYNC_MAX_WAIT_COUNT + 1];

	const __u32 count = args->count;

	size_t size = array_size(count, sizeof(fds[0]));

	struct ntsync_q *q;

	__u32 total_count;

	__u32 i, j;
@@ -880,15 +881,14 @@ static int setup_wait(struct ntsync_device *dev, 
	if (args->pad || (args->flags & ~NTSYNC_WAIT_REALTIME))

		return -EINVAL;



	if (args->count > NTSYNC_MAX_WAIT_COUNT)

	if (size >= sizeof(fds))

		return -EINVAL;



	total_count = count;

	if (args->alert)

		total_count++;



	if (copy_from_user(fds, u64_to_user_ptr(args->objs),

			   array_size(count, sizeof(*fds))))

	if (copy_from_user(fds, u64_to_user_ptr(args->objs), size))

		return -EFAULT;

	if (args->alert)

		fds[count] = args->alert;