From: xiongweimin <[email protected]> The multiplication sizeof(*dst) * num could potentially overflow if num is very large. Use size_mul_overflow() for overflow-safe multiplication, consistent with patterns used elsewhere in the kernel.
Signed-off-by: Weimin Xiong <[email protected]> Co-authored-by: Cursor <[email protected]> --- drivers/vhost/vringh.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c index 9066f9f12..b4a06454f 100644 --- a/drivers/vhost/vringh.c +++ b/drivers/vhost/vringh.c @@ -9,6 +9,7 @@ #include <linux/vringh.h> #include <linux/virtio_ring.h> #include <linux/kernel.h> +#include <linux/overflow.h> #include <linux/ratelimit.h> #include <linux/uaccess.h> #include <linux/slab.h> @@ -621,8 +622,11 @@ static inline int putused_user(const struct vringh *vrh, const struct vring_used_elem *src, unsigned int num) { - return copy_to_user((__force void __user *)dst, src, - sizeof(*dst) * num) ? -EFAULT : 0; + size_t total_size; + + if (unlikely(size_mul_overflow(sizeof(*dst), num, &total_size))) + return -EINVAL; + return copy_to_user((__force void __user *)dst, src, total_size) ? -EFAULT : 0; } static inline int xfer_from_user(const struct vringh *vrh, void *src, -- 2.43.0
