[PATCH 21/32] soc: qcom: apr: Use mem_to_flex_dup() with struct apr_rx_buf

[Kees Cook <keescook@xxxxxxxxxxxx>]

As part of the work to perform bounds checking on all memcpy() uses,
replace the open-coded a deserialization of bytes out of memory into a
trailing flexible array by using a flex_array.h helper to perform the
allocation, bounds checking, and copying.

Cc: Andy Gross <agross@xxxxxxxxxx>
Cc: Bjorn Andersson <bjorn.andersson@xxxxxxxxxx>
Cc: linux-arm-msm@xxxxxxxxxxxxxxx
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
---
 drivers/soc/qcom/apr.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/soc/qcom/apr.c b/drivers/soc/qcom/apr.c
index 3caabd873322..6cf6f6df276e 100644
--- a/drivers/soc/qcom/apr.c
+++ b/drivers/soc/qcom/apr.c
@@ -40,8 +40,8 @@ struct packet_router {
 
 struct apr_rx_buf {
        struct list_head node;
-       int len;
-       uint8_t buf[];
+       DECLARE_FLEX_ARRAY_ELEMENTS_COUNT(int, len);
+       DECLARE_FLEX_ARRAY_ELEMENTS(uint8_t, buf);
 };
 
 /**
@@ -162,7 +162,7 @@ static int apr_callback(struct rpmsg_device *rpdev, void 
*buf,
                                  int len, void *priv, u32 addr)
 {
        struct packet_router *apr = dev_get_drvdata(&rpdev->dev);
-       struct apr_rx_buf *abuf;
+       struct apr_rx_buf *abuf = NULL;
        unsigned long flags;
 
        if (len <= APR_HDR_SIZE) {
@@ -171,13 +171,9 @@ static int apr_callback(struct rpmsg_device *rpdev, void 
*buf,
                return -EINVAL;
        }
 
-       abuf = kzalloc(sizeof(*abuf) + len, GFP_ATOMIC);
-       if (!abuf)
+       if (mem_to_flex_dup(&abuf, buf, len, GFP_ATOMIC))
                return -ENOMEM;
 
-       abuf->len = len;
-       memcpy(abuf->buf, buf, len);
-
        spin_lock_irqsave(&apr->rx_lock, flags);
        list_add_tail(&abuf->node, &apr->rx_list);
        spin_unlock_irqrestore(&apr->rx_lock, flags);
-- 
2.32.0