On 6/23/23 2:14 PM, Julia Lawall wrote:
Use array_size to protect against multiplication overflows.
The changes were done using the following Coccinelle semantic patch:
// <smpl>
@@
expression E1, E2;
constant C1, C2;
identifier alloc = {vmalloc,vzalloc};
@@
(
alloc(C1 * C2,...)
|
alloc(
- (E1) * (E2)
+ array_size(E1, E2)
,...)
)
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@xxxxxxxx>
Thanks,
Acked-by: Shannon Nelson <shannon.nelson@xxxxxxx>
---
drivers/net/ethernet/pensando/ionic/ionic_lif.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
index 957027e546b3..f2e2c6853536 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -560,7 +560,7 @@ static int ionic_qcq_alloc(struct ionic_lif *lif, unsigned int type,
new->q.dev = dev;
new->flags = flags;
- new->q.info = vzalloc(num_descs * sizeof(*new->q.info));
+ new->q.info = vzalloc(array_size(num_descs, sizeof(*new->q.info)));
if (!new->q.info) {
netdev_err(lif->netdev, "Cannot allocate queue info\n");
err = -ENOMEM;
@@ -581,7 +581,7 @@ static int ionic_qcq_alloc(struct ionic_lif *lif, unsigned int type,
if (err)
goto err_out;
- new->cq.info = vzalloc(num_descs * sizeof(*new->cq.info));
+ new->cq.info = vzalloc(array_size(num_descs, sizeof(*new->cq.info)));
if (!new->cq.info) {
netdev_err(lif->netdev, "Cannot allocate completion queue info\n");
err = -ENOMEM;
--
You received this message because you are subscribed to the Google Groups "Pensando Drivers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to drivers+unsubscribe@xxxxxxxxxxx.
To view this discussion on the web visit https://groups.google.com/a/pensando.io/d/msgid/drivers/20230623211457.102544-12-Julia.Lawall%40inria.fr.
