diff options
| author | Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru> | 2022-11-29 09:23:38 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-12-31 13:32:00 +0100 |
| commit | caaa3b42a204c6d2ec226e92df45199933e850a3 (patch) | |
| tree | c268ee91f7553f6e9f8b41299a75f1746a9c71d7 | |
| parent | ab2f429240b8a5227300c37e2a7a52f165b750d1 (diff) | |
| download | linux-caaa3b42a204c6d2ec226e92df45199933e850a3.tar.gz linux-caaa3b42a204c6d2ec226e92df45199933e850a3.tar.bz2 linux-caaa3b42a204c6d2ec226e92df45199933e850a3.zip | |
relay: fix type mismatch when allocating memory in relay_create_buf()
[ Upstream commit 4d8586e04602fe42f0a782d2005956f8b6302678 ]
The 'padding' field of the 'rchan_buf' structure is an array of 'size_t'
elements, but the memory is allocated for an array of 'size_t *' elements.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Link: https://lkml.kernel.org/r/20221129092002.3538384-1-Ilia.Gavrilov@infotecs.ru
Fixes: b86ff981a825 ("[PATCH] relay: migrate from relayfs to a generic relay API")
Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: wuchi <wuchi.zero@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | kernel/relay.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/kernel/relay.c b/kernel/relay.c index d7edc934c56d..88bcb09f0a1f 100644 --- a/kernel/relay.c +++ b/kernel/relay.c @@ -148,13 +148,13 @@ static struct rchan_buf *relay_create_buf(struct rchan *chan) { struct rchan_buf *buf; - if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t *)) + if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t)) return NULL; buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL); if (!buf) return NULL; - buf->padding = kmalloc_array(chan->n_subbufs, sizeof(size_t *), + buf->padding = kmalloc_array(chan->n_subbufs, sizeof(size_t), GFP_KERNEL); if (!buf->padding) goto free_buf; |