Let the kememdup_array() take care about multiplication and possible overflows. v2: -Change sizeof(limits[0]) to sizeof(*limits) -Fix title prefix Signed-off-by: Yu Jiaoliang <yujiaoliang@xxxxxxxx> Reviewed-by: Christophe JAILLET <christophe.jaillet@xxxxxxxxxx> Reviewed-by: Kalle Valo <kvalo@xxxxxxxxxx> --- net/wireless/util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/wireless/util.c b/net/wireless/util.c index 9a7c3adc8a3b..e7c1ac2a0f2d 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -2435,8 +2435,8 @@ int cfg80211_iter_combinations(struct wiphy *wiphy, if (params->num_different_channels > c->num_different_channels) continue; - limits = kmemdup(c->limits, sizeof(limits[0]) * c->n_limits, - GFP_KERNEL); + limits = kmemdup_array(c->limits, c->n_limits, sizeof(*limits), + GFP_KERNEL); if (!limits) return -ENOMEM; -- 2.34.1
