On Thu, Aug 23, 2018 at 10:31 AM, Gustavo A. R. Silva <gustavo@xxxxxxxxxxxxxx> wrote: > A common flaw in the kernel is integer overflow during memory allocation > size calculations. In an effort to reduce the frequency of these bugs, > kmalloc_array was implemented, which allocates memory for an array, > while at the same time detects integer overflow. > > This patch replaces cases of: > > kmalloc(a * b, gfp) > > with: > kmalloc_array(a * b, gfp) nit: this should be "kmalloc_array(a, b, gfp)" (This was a typo from my treewide commit message... :P) > Signed-off-by: Gustavo A. R. Silva <gustavo@xxxxxxxxxxxxxx> > --- > drivers/usb/misc/iowarrior.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c > index c2991b8..7a22400 100644 > --- a/drivers/usb/misc/iowarrior.c > +++ b/drivers/usb/misc/iowarrior.c > @@ -808,7 +808,7 @@ static int iowarrior_probe(struct usb_interface *interface, > dev->int_in_endpoint->bInterval); > /* create an internal buffer for interrupt data from the device */ > dev->read_queue = > - kmalloc(((dev->report_size + 1) * MAX_INTERRUPT_BUFFER), > + kmalloc_array(dev->report_size + 1, MAX_INTERRUPT_BUFFER, > GFP_KERNEL); For this patch with the commit log updated: Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx> Thanks! -Kees -- Kees Cook Pixel Security
