Commit 23feefda authored Aug 23, 2018 by Gustavo A. R. Silva Committed by Greg Kroah-Hartman Sep 10, 2018

usb: iowarrior: replace kmalloc with kmalloc_array



A common flaw in the kernel is integer overflow during memory allocation
size calculations. In an effort to reduce the frequency of these bugs,
kmalloc_array was implemented, which allocates memory for an array,
while at the same time detects integer overflow.

This patch replaces cases of:

	kmalloc(a * b, gfp)

with:
	kmalloc_array(a, b, gfp)

Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 87f88dfc

drivers/usb/misc/iowarrior.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -808,7 +808,7 @@ static int iowarrior_probe(struct usb_interface *interface,
		dev->int_in_endpoint->bInterval);
		/* create an internal buffer for interrupt data from the device */
		dev->read_queue =
		kmalloc(((dev->report_size + 1) * MAX_INTERRUPT_BUFFER),
		kmalloc_array(dev->report_size + 1, MAX_INTERRUPT_BUFFER,
		GFP_KERNEL);
		if (!dev->read_queue)
		goto error;