Let the krealloc_array() copy the original data and check for a multiplication overflow. Signed-off-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx> --- drivers/iio/industrialio-core.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c index 90e59223b178..be154879983e 100644 --- a/drivers/iio/industrialio-core.c +++ b/drivers/iio/industrialio-core.c @@ -1465,7 +1465,7 @@ int iio_device_register_sysfs_group(struct iio_dev *indio_dev, const struct attribute_group **new, **old = iio_dev_opaque->groups; unsigned int cnt = iio_dev_opaque->groupcounter; - new = krealloc(old, sizeof(*new) * (cnt + 2), GFP_KERNEL); + new = krealloc_array(old, cnt + 2, sizeof(*new), GFP_KERNEL); if (!new) return -ENOMEM; @@ -1483,13 +1483,13 @@ static int iio_device_register_sysfs(struct iio_dev *indio_dev) { struct iio_dev_opaque *iio_dev_opaque = to_iio_dev_opaque(indio_dev); int i, ret = 0, attrcount, attrn, attrcount_orig = 0; + struct attribute **attrs, **attr, *clk = NULL; struct iio_dev_attr *p; - struct attribute **attr, *clk = NULL; /* First count elements in any existing group */ - if (indio_dev->info->attrs) { - attr = indio_dev->info->attrs->attrs; - while (*attr++ != NULL) + attrs = indio_dev->info->attrs ? indio_dev->info->attrs->attrs : NULL; + if (attrs) { + for (attr = attrs; *attr; attr++) attrcount_orig++; } attrcount = attrcount_orig; @@ -1521,20 +1521,14 @@ static int iio_device_register_sysfs(struct iio_dev *indio_dev) if (clk) attrcount++; + /* Copy across original attributes, and point to original binary attributes */ iio_dev_opaque->chan_attr_group.attrs = - kcalloc(attrcount + 1, - sizeof(iio_dev_opaque->chan_attr_group.attrs[0]), - GFP_KERNEL); + krealloc_array(attrs, attrcount + 1, sizeof(*attrs), GFP_KERNEL); if (iio_dev_opaque->chan_attr_group.attrs == NULL) { ret = -ENOMEM; goto error_clear_attrs; } - /* Copy across original attributes, and point to original binary attributes */ if (indio_dev->info->attrs) { - memcpy(iio_dev_opaque->chan_attr_group.attrs, - indio_dev->info->attrs->attrs, - sizeof(iio_dev_opaque->chan_attr_group.attrs[0]) - *attrcount_orig); iio_dev_opaque->chan_attr_group.is_visible = indio_dev->info->attrs->is_visible; iio_dev_opaque->chan_attr_group.bin_attrs = -- 2.40.0.1.gaa8946217a0b