Use array_size() when calculating the parser table allocation size so an
overflow in the firmware-provided item dimensions is detected before
allocation. Include the overflow helpers explicitly instead of relying on
an indirect include.

Signed-off-by: Weimin Xiong <[email protected]>
---
diff --git a/drivers/net/ethernet/intel/ice/ice_parser.c 
b/drivers/net/ethernet/intel/ice/ice_parser.c
index f8e69630f..c109d3c32 100644
--- a/drivers/net/ethernet/intel/ice/ice_parser.c
+++ b/drivers/net/ethernet/intel/ice/ice_parser.c
@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0
 /* Copyright (C) 2024 Intel Corporation */
 
+#include <linux/overflow.h>
+
 #include "ice_common.h"
 
 struct ice_pkg_sect_hdr {
@@ -102,7 +104,7 @@ ice_parser_create_table(struct ice_hw *hw, u32 sect_type,
        if (!seg)
                return ERR_PTR(-EINVAL);
 
-       table = kzalloc(item_size * length, GFP_KERNEL);
+       table = kzalloc(array_size(item_size, length), GFP_KERNEL);
        if (!table)
                return ERR_PTR(-ENOMEM);
 

Reply via email to