[PATCH 31/32] xenbus: Use mem_to_flex_dup() with struct read_buffer

[Kees Cook <keescook@xxxxxxxxxxxx>]

As part of the work to perform bounds checking on all memcpy() uses,
replace the open-coded a deserialization of bytes out of memory into a
trailing flexible array by using a flex_array.h helper to perform the
allocation, bounds checking, and copying.

Cc: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>
Cc: Juergen Gross <jgross@xxxxxxxx>
Cc: Stefano Stabellini <sstabellini@xxxxxxxxxx>
Cc: xen-devel@xxxxxxxxxxxxxxxxxxxx
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
---
 drivers/xen/xenbus/xenbus_dev_frontend.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c 
b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 597af455a522..4267aaef33fb 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -81,8 +81,8 @@ struct xenbus_transaction_holder {
 struct read_buffer {
        struct list_head list;
        unsigned int cons;
-       unsigned int len;
-       char msg[];
+       DECLARE_FLEX_ARRAY_ELEMENTS_COUNT(unsigned int, len);
+       DECLARE_FLEX_ARRAY_ELEMENTS(char, msg);
 };
 
 struct xenbus_file_priv {
@@ -188,21 +188,17 @@ static ssize_t xenbus_file_read(struct file *filp,
  */
 static int queue_reply(struct list_head *queue, const void *data, size_t len)
 {
-       struct read_buffer *rb;
+       struct read_buffer *rb = NULL;
 
        if (len == 0)
                return 0;
        if (len > XENSTORE_PAYLOAD_MAX)
                return -EINVAL;
 
-       rb = kmalloc(sizeof(*rb) + len, GFP_KERNEL);
-       if (rb == NULL)
+       if (mem_to_flex_dup(&rb, data, len, GFP_KERNEL))
                return -ENOMEM;
 
        rb->cons = 0;
-       rb->len = len;
-
-       memcpy(rb->msg, data, len);
 
        list_add_tail(&rb->list, queue);
        return 0;
-- 
2.32.0