On Wed, 2020-08-19 at 12:10 -0700, Jakub Kicinski wrote: > > + memset(&state->policies[state->n_alloc], 0, > > + sizeof(state->policies[0]) * (n_alloc - state->n_alloc)); > > [flex_]array_size() ? To avoid the inevitable follow up from a bot..
Yeah, hmm. I suppose you know this but we can't really overflow anything here since all of the factors are kernel controlled; you can't really have enough policies in memory to overflow this, I'd think. We walk the constant policies and their nested policies - nl80211 is a *heavy* user and only recently went >10 policies linked together (triggering the bug)... Really what we need is kzrealloc() ;-) I'll send a v2 using flex_array_size(), it doesn't look any worse and I don't care about the overflow check either since it's not at all a fast- path. johannes
