Forwarding this to the linux-audit mailing list. ---------- Forwarded message --------- From: Xiu Jianfeng <xiujianfeng(a)huawei.com&gt; Date: Wed, Dec 15, 2021 at 9:08 PM Subject: [PATCH -next, v3 1/2] audit: use struct_size() helper in audit_[send|make]_reply() To: <paul(a)paul-moore.com&gt;, <eparis(a)redhat.com&gt;, <keescook(a)chromium.org&gt;, <gustavoars(a)kernel.org&gt; Cc: <linux-kernel(a)vger.kernel.org&gt;, <linux-hardening(a)vger.kernel.org&gt; Make use of struct_size() helper instead of an open-coded calculation. Link: https://github.com/KSPP/linux/issues/160 Signed-off-by: Xiu Jianfeng <xiujianfeng(a)huawei.com&gt; --- kernel/audit.c | 2 +- kernel/auditfilter.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index f33028578c60..7778eca34837 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1459,7 +1459,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) security_release_secctx(ctx, len); } audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0, - sig_data, sizeof(*sig_data) + len); + sig_data, struct_size(sig_data, ctx, len)); kfree(sig_data); break; case AUDIT_TTY_GET: { diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 19352820b274..42d99896e7a6 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -1092,7 +1092,7 @@ static void audit_list_rules(int seq, struct sk_buff_head *q) break; skb = audit_make_reply(seq, AUDIT_LIST_RULES, 0, 1, data, - sizeof(*data) + data->buflen); + struct_size(data, buf, data->buflen)); if (skb) skb_queue_tail(q, skb); kfree(data); -- 2.17.1