From: Gustavo A. R. Silva Date: Tue, 28 Sep 2021 23:39:35 +0000 (-0500) Subject: usb: atm: Use struct_size() helper X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=b626871a7cda136fc88c11c486c2f87df59d0dee;p=linux.git usb: atm: Use struct_size() helper Make use of the struct_size() helper instead of an open-coded version, in order to avoid any potential type mistakes or integer overflows that, in the worse scenario, could lead to heap overflows. Link: https://github.com/KSPP/linux/issues/160 Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20210928233935.GA299525@embeddedor Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c index 33ae03ac13a68..da17be1ef64e2 100644 --- a/drivers/usb/atm/usbatm.c +++ b/drivers/usb/atm/usbatm.c @@ -1015,9 +1015,11 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id, int error = -ENOMEM; int i, length; unsigned int maxpacket, num_packets; + size_t size; /* instance init */ - instance = kzalloc(sizeof(*instance) + sizeof(struct urb *) * (num_rcv_urbs + num_snd_urbs), GFP_KERNEL); + size = struct_size(instance, urbs, num_rcv_urbs + num_snd_urbs); + instance = kzalloc(size, GFP_KERNEL); if (!instance) return -ENOMEM;