[PATCH 3/3] bcachefs: chardev: fix an integer overflow (32 bit only)

[Dan Carpenter]

On 32 bit systems, "sizeof(*arg) + replica_entries_bytes" can have an
integer overflow leading to memory corruption.  Use size_add() to
prevent this.

Fixes: b44dd3797034 ("bcachefs: Redo filesystem usage ioctls")
Signed-off-by: Dan Carpenter <dan.carpen...@linaro.org>
---
 fs/bcachefs/chardev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/bcachefs/chardev.c b/fs/bcachefs/chardev.c
index 5556bb2dc539..12dcf1f288dc 100644
--- a/fs/bcachefs/chardev.c
+++ b/fs/bcachefs/chardev.c
@@ -421,7 +421,7 @@ static long bch2_ioctl_fs_usage(struct bch_fs *c,
        if (get_user(replica_entries_bytes, &user_arg->replica_entries_bytes))
                return -EFAULT;
 
-       arg = kzalloc(sizeof(*arg) + replica_entries_bytes, GFP_KERNEL);
+       arg = kzalloc(size_add(sizeof(*arg), replica_entries_bytes), 
GFP_KERNEL);
        if (!arg)
                return -ENOMEM;
 
-- 
2.39.2