On 8/23/18 12:43 PM, Kees Cook wrote: > On Thu, Aug 23, 2018 at 10:31 AM, Gustavo A. R. Silva > <gustavo@xxxxxxxxxxxxxx> wrote: >> A common flaw in the kernel is integer overflow during memory allocation >> size calculations. In an effort to reduce the frequency of these bugs, >> kmalloc_array was implemented, which allocates memory for an array, >> while at the same time detects integer overflow. >> >> This patch replaces cases of: >> >> kmalloc(a * b, gfp) >> >> with: >> kmalloc_array(a * b, gfp) > > nit: this should be "kmalloc_array(a, b, gfp)" (This was a typo from > my treewide commit message... :P) > Oops... OK. V3 is on the way. :P >> Signed-off-by: Gustavo A. R. Silva <gustavo@xxxxxxxxxxxxxx> >> --- >> drivers/usb/misc/iowarrior.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c >> index c2991b8..7a22400 100644 >> --- a/drivers/usb/misc/iowarrior.c >> +++ b/drivers/usb/misc/iowarrior.c >> @@ -808,7 +808,7 @@ static int iowarrior_probe(struct usb_interface *interface, >> dev->int_in_endpoint->bInterval); >> /* create an internal buffer for interrupt data from the device */ >> dev->read_queue = >> - kmalloc(((dev->report_size + 1) * MAX_INTERRUPT_BUFFER), >> + kmalloc_array(dev->report_size + 1, MAX_INTERRUPT_BUFFER, >> GFP_KERNEL); > > For this patch with the commit log updated: > > Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx> > Thanks! -- Gustavo
