The struct avs_modcfg_ext structure has a flexible array member for the pin_fmts array, and the size should be calculated using struct_size to prevent the potential for overflow with the allocation. Reviewed-by: Cezary Rojewski <cezary.rojewski@xxxxxxxxx> Reviewed-by: "Amadeusz Sławiński" <amadeuszx.slawinski@xxxxxxxxxxxxxxx> Signed-off-by: Jacob Keller <jacob.e.keller@xxxxxxxxx> --- sound/soc/intel/avs/path.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/intel/avs/path.c b/sound/soc/intel/avs/path.c index 05302ab705ae..adbe23a47847 100644 --- a/sound/soc/intel/avs/path.c +++ b/sound/soc/intel/avs/path.c @@ -478,7 +478,7 @@ static int avs_modext_create(struct avs_dev *adev, struct avs_path_module *mod) int ret, i; num_pins = tcfg->generic.num_input_pins + tcfg->generic.num_output_pins; - cfg_size = sizeof(*cfg) + sizeof(*cfg->pin_fmts) * num_pins; + cfg_size = struct_size(cfg, pin_fmts, num_pins); cfg = kzalloc(cfg_size, GFP_KERNEL); if (!cfg) base-commit: ee3f96b164688dae21e2466a57f2e806b64e8a37 -- 2.39.1.405.gd4c25cc71f83
