Use array_size to protect against multiplication overflows. The changes were done using the following Coccinelle semantic patch: // <smpl> @@ expression E1, E2; constant C1, C2; identifier alloc = {vmalloc,vzalloc}; @@ ( alloc(C1 * C2,...) | alloc( - (E1) * (E2) + array_size(E1, E2) ,...) ) // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@xxxxxxxx> --- drivers/net/ethernet/freescale/enetc/enetc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c index 9e1b2536e9a9..7231f8ea1ba4 100644 --- a/drivers/net/ethernet/freescale/enetc/enetc.c +++ b/drivers/net/ethernet/freescale/enetc/enetc.c @@ -1790,7 +1790,7 @@ static int enetc_alloc_tx_resource(struct enetc_bdr_resource *res, res->bd_count = bd_count; res->bd_size = sizeof(union enetc_tx_bd); - res->tx_swbd = vzalloc(bd_count * sizeof(*res->tx_swbd)); + res->tx_swbd = vzalloc(array_size(bd_count, sizeof(*res->tx_swbd))); if (!res->tx_swbd) return -ENOMEM; @@ -1878,7 +1878,7 @@ static int enetc_alloc_rx_resource(struct enetc_bdr_resource *res, if (extended) res->bd_size *= 2; - res->rx_swbd = vzalloc(bd_count * sizeof(struct enetc_rx_swbd)); + res->rx_swbd = vzalloc(array_size(bd_count, sizeof(struct enetc_rx_swbd))); if (!res->rx_swbd) return -ENOMEM;