Use array_size to protect against multiplication overflows. The changes were done using the following Coccinelle semantic patch: // <smpl> @@ size_t e1,e2; expression COUNT; identifier alloc = {vmalloc,vzalloc,kvmalloc,kvzalloc}; @@ ( alloc( - (e1) * (e2) + array_size(e1, e2) ,...) | alloc( - (e1) * (COUNT) + array_size(COUNT, e1) ,...) ) // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@xxxxxxxx> --- drivers/comedi/comedi_buf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/comedi/comedi_buf.c b/drivers/comedi/comedi_buf.c index 393966c09740..32ad3e6e1ce8 100644 --- a/drivers/comedi/comedi_buf.c +++ b/drivers/comedi/comedi_buf.c @@ -89,7 +89,7 @@ comedi_buf_map_alloc(struct comedi_device *dev, enum dma_data_direction dma_dir, bm->dma_hw_dev = get_device(dev->hw_dev); } - bm->page_list = vzalloc(sizeof(*buf) * n_pages); + bm->page_list = vzalloc(array_size(n_pages, sizeof(*buf))); if (!bm->page_list) goto err; @@ -169,7 +169,7 @@ static void __comedi_buf_alloc(struct comedi_device *dev, buf = &bm->page_list[0]; async->prealloc_buf = buf->virt_addr; } else { - pages = vmalloc(sizeof(struct page *) * n_pages); + pages = vmalloc(array_size(n_pages, sizeof(struct page *))); if (!pages) return;