and memset() The vmalloc() function has no 2-factor argument form, so multiplication factors need to be wrapped in array_size(). Also, while there, use array_size() in memset(). This issue was found with the help of Coccinelle and, audited and fixed manually. Addresses-KSPP-ID: https://github.com/KSPP/linux/issues/83 Signed-off-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx> --- drivers/staging/rts5208/ms.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/staging/rts5208/ms.c b/drivers/staging/rts5208/ms.c index d53dd138a356..9001570a8c94 100644 --- a/drivers/staging/rts5208/ms.c +++ b/drivers/staging/rts5208/ms.c @@ -2306,14 +2306,14 @@ static int ms_build_l2p_tbl(struct rtsx_chip *chip, int seg_no) if (!segment->l2p_table) goto BUILD_FAIL; } - memset((u8 *)(segment->l2p_table), 0xff, table_size * 2); + memset((u8 *)(segment->l2p_table), 0xff, array_size(table_size, 2)); if (!segment->free_table) { - segment->free_table = vmalloc(MS_FREE_TABLE_CNT * 2); + segment->free_table = vmalloc(array_size(MS_FREE_TABLE_CNT, 2)); if (!segment->free_table) goto BUILD_FAIL; } - memset((u8 *)(segment->free_table), 0xff, MS_FREE_TABLE_CNT * 2); + memset((u8 *)(segment->free_table), 0xff, array_size(MS_FREE_TABLE_CNT, 2)); start = (u16)seg_no << 9; end = (u16)(seg_no + 1) << 9; -- 2.27.0 _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
