On 1/28/24 5:27 AM, Erick Archer wrote:
This is an effort to get rid of all multiplications from allocation functions in order to prevent integer overflows [1]. Here the multiplication is obviously safe because the "event_rings" member never can have a value greater than 255 (8 bits). This member is set twice using always FIELD_GET: mhi_cntrl->event_rings = FIELD_GET(MHICFG_NER_MASK, regval); mhi_cntrl->event_rings = FIELD_GET(MHICFG_NER_MASK, regval); And the MHICFG_NER_MASK macro defines the 8 bits mask that guarantees a maximum value of 255. However, using kcalloc() is more appropriate [1] and improves readability. This patch has no effect on runtime behavior. Link: https://github.com/KSPP/linux/issues/162 [1] Link: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments [1] Reviewed-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx> Signed-off-by: Erick Archer <erick.archer@xxxxxxx> --- Changes in v2: - Add more info in the commit message to better explain the change. (Dan Carpenter) - Add the "Reviewed-by:" tag.
Looks good. Reviewed-by: Alex Elder <elder@xxxxxxxxxx>
Previous versions: v1 - https://lore.kernel.org/linux-hardening/20240120152518.13006-1-erick.archer@xxxxxxx/ --- drivers/bus/mhi/ep/main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c index 65fc1d738bec..8d7a4102bdb7 100644 --- a/drivers/bus/mhi/ep/main.c +++ b/drivers/bus/mhi/ep/main.c @@ -1149,8 +1149,9 @@ int mhi_ep_power_up(struct mhi_ep_cntrl *mhi_cntrl) mhi_ep_mmio_mask_interrupts(mhi_cntrl); mhi_ep_mmio_init(mhi_cntrl); - mhi_cntrl->mhi_event = kzalloc(mhi_cntrl->event_rings * (sizeof(*mhi_cntrl->mhi_event)), - GFP_KERNEL); + mhi_cntrl->mhi_event = kcalloc(mhi_cntrl->event_rings, + sizeof(*mhi_cntrl->mhi_event), + GFP_KERNEL); if (!mhi_cntrl->mhi_event) return -ENOMEM; -- 2.25.1
