On 2022-09-01 at 08:18:45 +0300, Dan Carpenter wrote:
> The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit
> systems leading to memory corruption. Use array_size() to fix that.
>
> Fixes: 322b598be4d9 ("fpga: dfl: introduce interrupt trigger setting API")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Acked-by: Xu Yilun <yilun.xu@xxxxxxxxx>
Applied to fpga for-next.
Thanks
Yilun
> ---
> drivers/fpga/dfl.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c
> index 5498bc337f8b..b9aae85ba930 100644
> --- a/drivers/fpga/dfl.c
> +++ b/drivers/fpga/dfl.c
> @@ -1866,7 +1866,7 @@ long dfl_feature_ioctl_set_irq(struct platform_device *pdev,
> return -EINVAL;
>
> fds = memdup_user((void __user *)(arg + sizeof(hdr)),
> - hdr.count * sizeof(s32));
> + array_size(hdr.count, sizeof(s32)));
> if (IS_ERR(fds))
> return PTR_ERR(fds);
>
> --
> 2.35.1
>
