Use array_size() when calculating the parser table allocation size so an overflow in the firmware-provided item dimensions is detected before allocation. Include the overflow helpers explicitly instead of relying on an indirect include.
Signed-off-by: Weimin Xiong <[email protected]> --- diff --git a/drivers/net/ethernet/intel/ice/ice_parser.c b/drivers/net/ethernet/intel/ice/ice_parser.c index f8e69630f..c109d3c32 100644 --- a/drivers/net/ethernet/intel/ice/ice_parser.c +++ b/drivers/net/ethernet/intel/ice/ice_parser.c @@ -1,6 +1,8 @@ // SPDX-License-Identifier: GPL-2.0 /* Copyright (C) 2024 Intel Corporation */ +#include <linux/overflow.h> + #include "ice_common.h" struct ice_pkg_sect_hdr { @@ -102,7 +104,7 @@ ice_parser_create_table(struct ice_hw *hw, u32 sect_type, if (!seg) return ERR_PTR(-EINVAL); - table = kzalloc(item_size * length, GFP_KERNEL); + table = kzalloc(array_size(item_size, length), GFP_KERNEL); if (!table) return ERR_PTR(-ENOMEM);
