diff options
| author | Gustavo A. R. Silva <gustavoars@kernel.org> | 2023-09-15 22:25:36 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2023-09-18 11:39:41 +0300 |
| commit | 0201409079b975e46cc40e8bdff4bd61329ee10f (patch) | |
| tree | 3a0c71e1d04326f884e32f131b267d663a1a617c /drivers/net/ethernet/toshiba | |
| parent | 2506a91734754de690869824fb0d1ac592ec1266 (diff) | |
| download | linux-0201409079b975e46cc40e8bdff4bd61329ee10f.tar.xz | |
net: spider_net: Use size_add() in call to struct_size()
If, for any reason, the open-coded arithmetic causes a wraparound,
the protection that `struct_size()` adds against potential integer
overflows is defeated. Fix this by hardening call to `struct_size()`
with `size_add()`.
Fixes: 3f1071ec39f7 ("net: spider_net: Use struct_size() helper")
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/toshiba')
| -rw-r--r-- | drivers/net/ethernet/toshiba/spider_net.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c index 50d7eacfec58..87e67121477c 100644 --- a/drivers/net/ethernet/toshiba/spider_net.c +++ b/drivers/net/ethernet/toshiba/spider_net.c @@ -2332,7 +2332,7 @@ spider_net_alloc_card(void) struct spider_net_card *card; netdev = alloc_etherdev(struct_size(card, darray, - tx_descriptors + rx_descriptors)); + size_add(tx_descriptors, rx_descriptors))); if (!netdev) return NULL; |