diff options
| author | Gustavo A. R. Silva <gustavoars@kernel.org> | 2021-09-28 18:39:35 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-10-05 12:50:22 +0200 |
| commit | b626871a7cda136fc88c11c486c2f87df59d0dee (patch) | |
| tree | 15a4986d0437afa35e2a407707dbb6d6824e9774 | |
| parent | c1baf6c591e6901d3422d7a0d0d32ccf29883edf (diff) | |
usb: atm: Use struct_size() helper
Make use of the struct_size() helper instead of an open-coded version,
in order to avoid any potential type mistakes or integer overflows that,
in the worse scenario, could lead to heap overflows.
Link: https://github.com/KSPP/linux/issues/160
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/20210928233935.GA299525@embeddedor
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/atm/usbatm.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c index 33ae03ac13a6..da17be1ef64e 100644 --- a/drivers/usb/atm/usbatm.c +++ b/drivers/usb/atm/usbatm.c @@ -1015,9 +1015,11 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id, int error = -ENOMEM; int i, length; unsigned int maxpacket, num_packets; + size_t size; /* instance init */ - instance = kzalloc(sizeof(*instance) + sizeof(struct urb *) * (num_rcv_urbs + num_snd_urbs), GFP_KERNEL); + size = struct_size(instance, urbs, num_rcv_urbs + num_snd_urbs); + instance = kzalloc(size, GFP_KERNEL); if (!instance) return -ENOMEM; |