Commit bf580223 authored by Kees Cook's avatar Kees Cook Committed by Juergen Gross
Browse files

xen/gntalloc: Replace UAPI 1-element array 

Without changing the structure size (since it is UAPI), add a proper
flexible array member, and reference it in the kernel so that it will
not be trip the array-bounds sanitizer[1].

Link: https://github.com/KSPP/linux/issues/113

 [1]
Cc: Juergen Gross <jgross@suse.com>
Cc: Stefano Stabellini <sstabellini@kernel.org>
Cc: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Cc: xen-devel@lists.xenproject.org
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/20240206170320.work.437-kees@kernel.org


Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
parent b0f2f82c

drivers/xen/gntalloc.c

+1 −1
Original line number Diff line number Diff line
@@ -317,7 +317,7 @@ static long gntalloc_ioctl_alloc(struct gntalloc_file_private_data *priv, 
		rc = -EFAULT;

		goto out_free;

	}

	if (copy_to_user(arg->gref_ids, gref_ids,

	if (copy_to_user(arg->gref_ids_flex, gref_ids,

			sizeof(gref_ids[0]) * op.count)) {

		rc = -EFAULT;

		goto out_free;

include/uapi/xen/gntalloc.h

+4 −1
Original line number Diff line number Diff line
@@ -31,7 +31,10 @@ struct ioctl_gntalloc_alloc_gref { 
	__u64 index;

	/* The grant references of the newly created grant, one per page */

	/* Variable size, depending on count */

	union {

		__u32 gref_ids[1];

		__DECLARE_FLEX_ARRAY(__u32, gref_ids_flex);

	};

};



#define GNTALLOC_FLAG_WRITABLE 1