[PATCH 10/12] vhost-vringh: use size_mul() for overflow-safe multiplication

From: xiongweimin <[email protected]>

The multiplication sizeof(*dst) * num could potentially overflow if num
is very large. Use size_mul_overflow() for overflow-safe multiplication,
consistent with patterns used elsewhere in the kernel.

Signed-off-by: Weimin Xiong <[email protected]>
Co-authored-by: Cursor <[email protected]>
---
 drivers/vhost/vringh.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 9066f9f12..b4a06454f 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -9,6 +9,7 @@
 #include <linux/vringh.h>
 #include <linux/virtio_ring.h>
 #include <linux/kernel.h>
+#include <linux/overflow.h>
 #include <linux/ratelimit.h>
 #include <linux/uaccess.h>
 #include <linux/slab.h>
@@ -621,8 +622,11 @@ static inline int putused_user(const struct vringh *vrh,
 			       const struct vring_used_elem *src,
 			       unsigned int num)
 {
-	return copy_to_user((__force void __user *)dst, src,
-			    sizeof(*dst) * num) ? -EFAULT : 0;
+	size_t total_size;
+
+	if (unlikely(size_mul_overflow(sizeof(*dst), num, &total_size)))
+		return -EINVAL;
+	return copy_to_user((__force void __user *)dst, src, total_size) ? -EFAULT : 0;
 }
 
 static inline int xfer_from_user(const struct vringh *vrh, void *src,
-- 
2.43.0