Assign array_size() to variable _size_ and use it in both vzalloc() and memcpy(). These sorts of multiplication factors need to be wrapped in array_size(). This issue was found with the help of Coccinelle and, audited and fixed manually. Signed-off-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx> --- kernel/kexec_file.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 09cc78df53c6..4479d864aaf2 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -883,16 +883,16 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi, unsigned long offset; Elf_Shdr *sechdrs; int i; + size_t size = array_size(sizeof(Elf_Shdr), pi->ehdr->e_shnum); /* * The section headers in kexec_purgatory are read-only. In order to * have them modifiable make a temporary copy. */ - sechdrs = vzalloc(array_size(sizeof(Elf_Shdr), pi->ehdr->e_shnum)); + sechdrs = vzalloc(size); if (!sechdrs) return -ENOMEM; - memcpy(sechdrs, (void *)pi->ehdr + pi->ehdr->e_shoff, - pi->ehdr->e_shnum * sizeof(Elf_Shdr)); + memcpy(sechdrs, (void *)pi->ehdr + pi->ehdr->e_shoff, size); pi->sechdrs = sechdrs; offset = 0; -- 2.27.0 _______________________________________________ kexec mailing list kexec@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/kexec
