March 2022 - Kernel - mailweb.openeuler.org

议题补充：openEuler kernel 双周例会&技术分享
by tangjiayuan 17 Mar '22

17 Mar '22

增加议题： 14：10 - 14：30 [openEuler-22.03-LTS]建议在spec中对内核模块压缩减少磁盘消耗 - liuchao -----邮件原件----- 发件人: openEuler conference [mailto:public@openeuler.org] 发送时间: 2022年3月14日 10:53 收件人: kernel(a)openeuler.org; kernel-discuss(a)openeuler.org; tc(a)openeuler.org; dev(a)openeuler.org 主题: openEuler kernel 双周例会&技术分享您好！ Kernel SIG 邀请您参加 2022-03-18 14:00 召开的ZOOM会议(自动录制) 会议主题：openEuler kernel 双周例会&技术分享会议内容： openEuler kernel 技术分享：内核中断子系统介绍会议链接：https://us06web.zoom.us/j/82640076508?pwd=MktwWWxWR3ZqNFF4SlgwdGhwNlNDZz09 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the ZOOM conference(auto recording) will be held at 2022-03-18 14:00, The subject of the conference is openEuler kernel 双周例会&技术分享, Summary: openEuler kernel 技术分享：内核中断子系统介绍 You can join the meeting at https://us06web.zoom.us/j/82640076508?pwd=MktwWWxWR3ZqNFF4SlgwdGhwNlNDZz09. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/ _______________________________________________ Kernel-discuss mailing list -- kernel-discuss(a)openeuler.org To unsubscribe send an email to kernel-discuss-leave(a)openeuler.org

1 1

[openEuler-22.03-LTS]建议在spec中对内核模块压缩减少磁盘消耗
by liuchao (CR) 17 Mar '22

17 Mar '22

在kernel.spec中对内核模块进行压缩，压缩为.xz格式，可以减少内核模块约72%的磁盘消耗。对于openEuler操作系统，可以减少约175 MB磁盘消耗。目前openEuler中modprobe等工具都支持.xz格式的内核模块，该更改对正常使用无影响。此功能在centos、opensuse均已默认打开。压缩命令： find $RPM_BUILD_ROOT/lib/modules/ -type f -name '*.ko' | xargs -n1 -P`nproc --all` xz

2 1

[openEuler-5.10 1/9] Revert "audit: bugfix for infinite loop when flush the hold queue"
by Zheng Zengkai 17 Mar '22

17 Mar '22

From: Cui GaoSheng <cuigaosheng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186383 https://gitee.com/openeuler/kernel/issues/I4X1AI?from=project-issue CVE: NA -------------------------------- This reverts commit fcfdde9cfc503cfd191b7286f9c48077fb5bf420. Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- kernel/audit.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index 21be62bc8205..2a38cbaf3ddb 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -732,8 +732,6 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, if (!sk) { if (err_hook) (*err_hook)(skb); - if (queue == &audit_hold_queue) - goto out; continue; } @@ -750,8 +748,6 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, (*err_hook)(skb); if (rc == -EAGAIN) rc = 0; - if (queue == &audit_hold_queue) - goto out; /* continue to drain the queue */ continue; } else @@ -763,7 +759,6 @@ static int kauditd_send_queue(struct sock *sk, u32 portid, } } -out: return (rc >= 0 ? 0 : rc); } -- 2.20.1

1 8

[PATCH openEuler-5.10] arm/arm64: paravirt: Remove GPL from pv_ops export
by Zheng Zengkai 15 Mar '22

15 Mar '22

From: Zengruan Ye <yezengruan(a)huawei.com> virt inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4VZPC CVE: NA -------------------------------- Commit 63042c58affc ("KVM: arm64: Add interface to support vCPU preempted check") introduced paravirt spinlock operations, as pv_lock_ops was exported via EXPORT_SYMBOL(), while the pv_ops structure containing the pv lock operations is exported via EXPORT_SYMBOL_GPL(). Change that by using EXPORT_SYMBOL(pv_ops) for arm/arm64, as with the x86 architecture changes, the following: https://lore.kernel.org/all/20181029150116.25372-1-jgross@suse.com/T/#u Fixes: 63042c58affc ("KVM: arm64: Add interface to support vCPU preempted check") Signed-off-by: yezengruan <yezengruan(a)huawei.com> Reviewed-by: Keqian Zhu <zhukeqian1(a)huawei.com> Acked-by: Xie Xiuqi <xiexiuqi(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/arm/kernel/paravirt.c | 2 +- arch/arm64/kernel/paravirt.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm/kernel/paravirt.c b/arch/arm/kernel/paravirt.c index 4cfed91fe256..3c34f456e400 100644 --- a/arch/arm/kernel/paravirt.c +++ b/arch/arm/kernel/paravirt.c @@ -15,4 +15,4 @@ struct static_key paravirt_steal_enabled; struct static_key paravirt_steal_rq_enabled; struct paravirt_patch_template pv_ops; -EXPORT_SYMBOL_GPL(pv_ops); +EXPORT_SYMBOL(pv_ops); diff --git a/arch/arm64/kernel/paravirt.c b/arch/arm64/kernel/paravirt.c index 847b3c8b1218..ecbd2bf2e6fb 100644 --- a/arch/arm64/kernel/paravirt.c +++ b/arch/arm64/kernel/paravirt.c @@ -38,7 +38,7 @@ struct paravirt_patch_template pv_ops = { #endif .lock.vcpu_is_preempted = __native_vcpu_is_preempted, }; -EXPORT_SYMBOL_GPL(pv_ops); +EXPORT_SYMBOL(pv_ops); struct pv_time_stolen_time_region { struct pvclock_vcpu_stolen_time *kaddr; -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS] crypto: pcrypt - Fix user-after-free on module unload
by Laibin Qiu 15 Mar '22

15 Mar '22

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from linux-4.19.102 commit 47ef5cb878817127bd3d54c3578bbbd3f7c2bf2c CVE: NA ------------------------------- [ Upstream commit 07bfd9bdf568a38d9440c607b72342036011f727 ] On module unload of pcrypt we must unregister the crypto algorithms first and then tear down the padata structure. As otherwise the crypto algorithms are still alive and can be used while the padata structure is being freed. Fixes: 5068c7a883d1 ("crypto: pcrypt - Add pcrypt crypto...") Cc: <stable(a)vger.kernel.org> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- crypto/pcrypt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c index 00c7230acfed..4bf4bb5b1a8b 100644 --- a/crypto/pcrypt.c +++ b/crypto/pcrypt.c @@ -509,11 +509,12 @@ static int __init pcrypt_init(void) static void __exit pcrypt_exit(void) { + crypto_unregister_template(&pcrypt_tmpl); + pcrypt_fini_padata(&pencrypt); pcrypt_fini_padata(&pdecrypt); kset_unregister(pcrypt_kset); - crypto_unregister_template(&pcrypt_tmpl); } module_init(pcrypt_init); -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] lib/iov_iter: initialize "flags" in new pipe_buffer
by Laibin Qiu 14 Mar '22

14 Mar '22

From: Max Kellermann <max.kellermann(a)ionos.com> mainline inclusion from mainline-v5.17-rc6 commit 9d2231c5d74e13b2a0546fee6737ee4446017903 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4X1GI?from=project-issue CVE: NA -------------------------------- The functions copy_page_to_iter_pipe() and push_pipe() can both allocate a new pipe_buffer, but the "flags" member initializer is missing. Fixes: 241699cd72a8 ("new iov_iter flavour: pipe-backed") To: Alexander Viro <viro(a)zeniv.linux.org.uk> To: linux-fsdevel(a)vger.kernel.org To: linux-kernel(a)vger.kernel.org Cc: stable(a)vger.kernel.org Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- lib/iov_iter.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 25668139fc1f..b80320956caf 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -506,6 +506,7 @@ static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t by return 0; pipe->nrbufs++; buf->ops = &page_cache_pipe_buf_ops; + buf->flags = 0; get_page(buf->page = page); buf->offset = offset; buf->len = bytes; @@ -630,6 +631,7 @@ static size_t push_pipe(struct iov_iter *i, size_t size, break; pipe->nrbufs++; pipe->bufs[idx].ops = &default_pipe_buf_ops; + pipe->bufs[idx].flags = 0; pipe->bufs[idx].page = page; pipe->bufs[idx].offset = 0; if (left <= PAGE_SIZE) { -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS 0/3] bugfix for memory reliable
by Laibin Qiu 14 Mar '22

14 Mar '22

fix zoneref mapping problem and disable memory reliable if kdump is in progress. Reliable memory used by shmem will be accurate if swap is enabled. Changelog since v1: - update ac->preferred_zoneref - add patch on shmem in reliable_fb_find_zone Ma Wupeng (3): mm: disable memory reliable when kdump is in progress mm: fix zoneref mapping problem in memory reliable mm: Count reliable shmem used based on NR_SHMEM mm/filemap.c | 5 ++++- mm/khugepaged.c | 2 ++ mm/mem_reliable.c | 6 ++++++ mm/migrate.c | 5 +++++ mm/page_alloc.c | 25 ++++++++++++------------- mm/shmem.c | 7 ++----- 6 files changed, 31 insertions(+), 19 deletions(-) -- 2.22.0

1 3

[PATCH openEuler-1.0-LTS 1/2] mm: fix unable to use reliable memory in page cache
by Laibin Qiu 14 Mar '22

14 Mar '22

From: Chen Wandun <chenwandun(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA ---------------------------------------------- It is inaccurate when accumulate percpu variable without lock, it will result in pagecache_reliable_pages to be negative in sometime, and will prevent pagecache using reliable memory. For more accurate statistic, replace percpu variable by percpu_counter. The additional percpu_counter will be access in alloc_pages, the init of these two percpu_conter is too late in late_initcall, allocations that use alloc_pages should have to check if the two counter has been inited, that will introduce latency, in order to sovle this, init the two percpu_counter in advance. Signed-off-by: Chen Wandun <chenwandun(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- include/linux/mem_reliable.h | 17 +++++----- mm/mem_reliable.c | 62 ++++++++++++++++++------------------ mm/page_alloc.c | 5 +++ 3 files changed, 45 insertions(+), 39 deletions(-) diff --git a/include/linux/mem_reliable.h b/include/linux/mem_reliable.h index ba5d41edbc44..c4f954340ea7 100644 --- a/include/linux/mem_reliable.h +++ b/include/linux/mem_reliable.h @@ -21,8 +21,9 @@ extern bool shmem_reliable; extern struct percpu_counter reliable_shmem_used_nr_page; extern bool pagecache_use_reliable_mem; DECLARE_PER_CPU(long, nr_reliable_buddy_pages); -DECLARE_PER_CPU(long, pagecache_reliable_pages); -DECLARE_PER_CPU(long, anon_reliable_pages); + +extern struct percpu_counter pagecache_reliable_pages; +extern struct percpu_counter anon_reliable_pages; extern unsigned long nr_reliable_reserve_pages __read_mostly; extern long shmem_reliable_nr_page __read_mostly; @@ -43,6 +44,7 @@ extern void reliable_lru_add(enum lru_list lru, struct page *page, extern void page_cache_prepare_alloc(gfp_t *gfp); extern void reliable_lru_add_batch(int zid, enum lru_list lru, int val); +extern bool mem_reliable_counter_initialized(void); static inline bool mem_reliable_is_enabled(void) { @@ -81,13 +83,10 @@ static inline void reliable_page_counter(struct page *page, static inline bool reliable_mem_limit_check(unsigned long nr_page) { - int cpu; - long num = 0; + s64 num; - for_each_possible_cpu(cpu) { - num += per_cpu(pagecache_reliable_pages, cpu); - num += per_cpu(anon_reliable_pages, cpu); - } + num = percpu_counter_read_positive(&pagecache_reliable_pages); + num += percpu_counter_read_positive(&anon_reliable_pages); return num + nr_page <= task_reliable_limit / PAGE_SIZE; } @@ -184,6 +183,8 @@ static inline void reliable_lru_add(enum lru_list lru, static inline void page_cache_prepare_alloc(gfp_t *gfp) {} static inline void reliable_lru_add_batch(int zid, enum lru_list lru, int val) {} + +static inline bool mem_reliable_counter_initialized(void) { return false; } #endif #endif diff --git a/mm/mem_reliable.c b/mm/mem_reliable.c index 62df78657ff9..033af716610f 100644 --- a/mm/mem_reliable.c +++ b/mm/mem_reliable.c @@ -34,12 +34,18 @@ unsigned long nr_reliable_reserve_pages = MEM_RELIABLE_RESERVE_MIN / PAGE_SIZE; long shmem_reliable_nr_page = LONG_MAX; bool pagecache_use_reliable_mem __read_mostly = true; -DEFINE_PER_CPU(long, pagecache_reliable_pages); -DEFINE_PER_CPU(long, anon_reliable_pages); +struct percpu_counter pagecache_reliable_pages; +struct percpu_counter anon_reliable_pages; static unsigned long zero; static unsigned long reliable_pagecache_max_bytes = ULONG_MAX; +bool mem_reliable_counter_initialized(void) +{ + return likely(percpu_counter_initialized(&pagecache_reliable_pages)) && + likely((percpu_counter_initialized(&anon_reliable_pages))); +} + bool mem_reliable_status(void) { return mem_reliable_is_enabled(); @@ -66,9 +72,9 @@ void reliable_lru_add_batch(int zid, enum lru_list lru, int val) if (zid < ZONE_MOVABLE && zid >= 0) { if (is_file_lru(lru)) - this_cpu_add(pagecache_reliable_pages, val); + percpu_counter_add(&pagecache_reliable_pages, val); else if (is_anon_lru(lru)) - this_cpu_add(anon_reliable_pages, val); + percpu_counter_add(&anon_reliable_pages, val); } } @@ -78,14 +84,14 @@ void reliable_lru_add(enum lru_list lru, struct page *page, int val) return; if (is_file_lru(lru)) - this_cpu_add(pagecache_reliable_pages, val); + percpu_counter_add(&pagecache_reliable_pages, val); else if (is_anon_lru(lru)) - this_cpu_add(anon_reliable_pages, val); + percpu_counter_add(&anon_reliable_pages, val); else if (lru == LRU_UNEVICTABLE) { if (PageAnon(page)) - this_cpu_add(anon_reliable_pages, val); + percpu_counter_add(&anon_reliable_pages, val); else - this_cpu_add(pagecache_reliable_pages, val); + percpu_counter_add(&pagecache_reliable_pages, val); } } @@ -188,21 +194,20 @@ static void show_val_kb(struct seq_file *m, const char *s, unsigned long num) void reliable_report_meminfo(struct seq_file *m) { bool pagecache_enabled = pagecache_reliable_is_enabled(); - long nr_pagecache_pages = 0; - long nr_anon_pages = 0; + s64 nr_pagecache_pages = 0; + s64 nr_anon_pages = 0; long nr_buddy_pages = 0; int cpu; if (!mem_reliable_is_enabled()) return; - for_each_possible_cpu(cpu) { + for_each_possible_cpu(cpu) nr_buddy_pages += per_cpu(nr_reliable_buddy_pages, cpu); - nr_anon_pages += per_cpu(anon_reliable_pages, cpu); - if (pagecache_enabled) - nr_pagecache_pages += - per_cpu(pagecache_reliable_pages, cpu); - } + + nr_anon_pages = percpu_counter_sum_positive(&anon_reliable_pages); + if (pagecache_enabled) + nr_pagecache_pages = percpu_counter_sum_positive(&pagecache_reliable_pages); show_val_kb(m, "ReliableTotal: ", total_reliable_mem_sz() >> PAGE_SHIFT); @@ -445,8 +450,7 @@ static struct ctl_table reliable_dir_table[] = { void page_cache_prepare_alloc(gfp_t *gfp) { - long nr_reliable = 0; - int cpu; + s64 nr_reliable = 0; if (!mem_reliable_is_enabled()) return; @@ -454,11 +458,7 @@ void page_cache_prepare_alloc(gfp_t *gfp) if (!pagecache_reliable_is_enabled()) goto no_reliable; - for_each_possible_cpu(cpu) - nr_reliable += this_cpu_read(pagecache_reliable_pages); - - if (nr_reliable < 0) - goto no_reliable; + nr_reliable = percpu_counter_read_positive(&pagecache_reliable_pages); if (nr_reliable > reliable_pagecache_max_bytes >> PAGE_SHIFT) goto no_reliable; @@ -480,9 +480,12 @@ static int __init reliable_sysctl_init(void) return -1; } + percpu_counter_init(&pagecache_reliable_pages, 0, GFP_KERNEL); + percpu_counter_init(&anon_reliable_pages, 0, GFP_KERNEL); + return 0; } -late_initcall(reliable_sysctl_init); +arch_initcall(reliable_sysctl_init); #else static void mem_reliable_ctrl_bit_disabled(int idx) {} #endif @@ -515,21 +518,18 @@ static void mem_reliable_feature_disable(int idx) void reliable_show_mem_info(void) { - int cpu; - long num = 0; + s64 num = 0; if (!mem_reliable_is_enabled()) return; - for_each_possible_cpu(cpu) { - num += per_cpu(anon_reliable_pages, cpu); - num += per_cpu(pagecache_reliable_pages, cpu); - } + num += percpu_counter_sum_positive(&anon_reliable_pages); + num += percpu_counter_sum_positive(&pagecache_reliable_pages); pr_info("ReliableTotal: %lu kB", total_reliable_mem_sz() >> 10); pr_info("ReliableUsed: %lu kB", used_reliable_mem_sz() >> 10); pr_info("task_reliable_limit: %lu kB", task_reliable_limit >> 10); - pr_info("reliable_user_used: %ld kB", num << (PAGE_SHIFT - 10)); + pr_info("reliable_user_used: %lld kB", num << (PAGE_SHIFT - 10)); } void mem_reliable_out_of_memory(gfp_t gfp_mask, unsigned int order, diff --git a/mm/page_alloc.c b/mm/page_alloc.c index fd4354d9ebad..dab62d1d3a6e 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -4674,6 +4674,11 @@ static inline bool prepare_before_alloc(gfp_t *gfp_mask, unsigned int order) * allocation trigger task_reliable_limit */ if (is_global_init(current)) { + if (!mem_reliable_counter_initialized()) { + *gfp_mask |= ___GFP_RELIABILITY; + return true; + } + if (reliable_mem_limit_check(1 << order) && mem_reliable_watermark_ok(1 << order)) *gfp_mask |= ___GFP_RELIABILITY; -- 2.22.0

1 1

openEuler kernel 双周例会&技术分享
by openEuler conference 14 Mar '22

14 Mar '22

您好！ Kernel SIG 邀请您参加 2022-03-18 14:00 召开的ZOOM会议(自动录制) 会议主题：openEuler kernel 双周例会&技术分享会议内容： openEuler kernel 技术分享：内核中断子系统介绍会议链接：https://us06web.zoom.us/j/82640076508?pwd=MktwWWxWR3ZqNFF4SlgwdGhwNlNDZz09 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the ZOOM conference(auto recording) will be held at 2022-03-18 14:00, The subject of the conference is openEuler kernel 双周例会&技术分享, Summary: openEuler kernel 技术分享：内核中断子系统介绍 You can join the meeting at https://us06web.zoom.us/j/82640076508?pwd=MktwWWxWR3ZqNFF4SlgwdGhwNlNDZz09. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
by Laibin Qiu 14 Mar '22

14 Mar '22

From: Jordy Zomer <jordy(a)pwning.systems> mainline inclusion from mainline-v5.17-rc1 commit 4fbcc1a4cb20fe26ad0225679c536c80f1648221 category: bugfix bugzilla: 186393 CVE: CVE-2022-26490 ------------------------------------------------- It appears that there are some buffer overflows in EVT_TRANSACTION. This happens because the length parameters that are passed to memcpy come directly from skb->data and are not guarded in any way. Signed-off-by: Jordy Zomer <jordy(a)pwning.systems> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Huang Guobin <huangguobin4(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/nfc/st21nfca/se.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c index fd967a38a94a..ced3c20d6453 100644 --- a/drivers/nfc/st21nfca/se.c +++ b/drivers/nfc/st21nfca/se.c @@ -332,6 +332,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, return -ENOMEM; transaction->aid_len = skb->data[1]; + + /* Checking if the length of the AID is valid */ + if (transaction->aid_len > sizeof(transaction->aid)) + return -EINVAL; + memcpy(transaction->aid, &skb->data[2], transaction->aid_len); @@ -341,6 +346,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, return -EPROTO; transaction->params_len = skb->data[transaction->aid_len + 3]; + + /* Total size is allocated (skb->len - 2) minus fixed array members */ + if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction))) + return -EINVAL; + memcpy(transaction->params, skb->data + transaction->aid_len + 4, transaction->params_len); -- 2.22.0

1 0