Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

usb: atm: Use struct_size() helper

Make use of the struct_size() helper instead of an open-coded version,
in order to avoid any potential type mistakes or integer overflows that,
in the worse scenario, could lead to heap overflows.

Link: https://github.com/KSPP/linux/issues/160
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/20210928233935.GA299525@embeddedor
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Gustavo A. R. Silva and committed by
Greg Kroah-Hartman
b626871a c1baf6c5

+3 -1
+3 -1
drivers/usb/atm/usbatm.c
··· 1015 1015 int error = -ENOMEM; 1016 1016 int i, length; 1017 1017 unsigned int maxpacket, num_packets; 1018 + size_t size; 1018 1019 1019 1020 /* instance init */ 1020 - instance = kzalloc(sizeof(*instance) + sizeof(struct urb *) * (num_rcv_urbs + num_snd_urbs), GFP_KERNEL); 1021 + size = struct_size(instance, urbs, num_rcv_urbs + num_snd_urbs); 1022 + instance = kzalloc(size, GFP_KERNEL); 1021 1023 if (!instance) 1022 1024 return -ENOMEM; 1023 1025