vhost: Use flex_array_size() helper in copy_from_user()

Make use of the flex_array_size() helper to calculate the size of a
flexible array member within an enclosing structure.

This helper offers defense-in-depth against potential integer
overflows, while at the same time makes it explicitly clear that
we are dealing with a flexible array member.

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/20200731130956.GA30525@embeddedor
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index d7b8df3edffcf489fe356c582e7f0eb81a75dd25..39183ed738a1728393c1f3b69fe297a69d1fc3dd 100644 (file)
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1405,7 +1405,7 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
 
        memcpy(newmem, &mem, size);
        if (copy_from_user(newmem->regions, m->regions,
-                          mem.nregions * sizeof *m->regions)) {
+                          flex_array_size(newmem, regions, mem.nregions))) {
                kvfree(newmem);
                return -EFAULT;
        }