From: Zichen Xie <zichenxie0106@xxxxxxxxx>
Like commit ac19c4c3d02e ("bcachefs: Use array_size() in call to
copy_from_user()"), it's a safer way to use helper array_size() in
copy_from_user() to avoid potential overflow issues.
Fixes: 7520a277d97b ("drm: Extract drm_framebuffer.[hc]")
Signed-off-by: Zichen Xie <zichenxie0106@xxxxxxxxx>
---
drivers/gpu/drm/drm_framebuffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index 888aadb6a4ac..323fb194ca17 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -752,7 +752,7 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
}
ret = copy_from_user(clips, clips_ptr,
- num_clips * sizeof(*clips));
+ array_size(num_clips, sizeof(*clips)));
if (ret) {
ret = -EFAULT;
goto out_err2;
--
2.34.1
