From: Kees Cook <[email protected]> In preparation for converting the kmalloc family of allocators to the type-aware kmalloc_obj family, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (The kmalloc family returns "void *", which can be implicitly cast to any pointer type.)
The new key map has as many entries as plain_map, but the size was taken from the whole array, which would make the allocation type a pointer to the array rather than the "unsigned short *" being assigned. Allocate ARRAY_SIZE-many entries instead. The resulting allocation size is the same. Build tested ARCH=x86_64 allmodconfig with GCC 16.2.0: drivers/tty/vt/keyboard.o Assisted-by: LLM coccinelle Signed-off-by: Kees Cook <[email protected]> --- Cc: Greg Kroah-Hartman <[email protected]> Cc: Jiri Slaby <[email protected]> Cc: Nicolas Pitre <[email protected]> Cc: <[email protected]> --- drivers/tty/vt/keyboard.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index c41d850b29c6..ef4a19aeb3ce 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -2002,7 +2002,9 @@ static int vt_kdskbent(unsigned char kbdmode, unsigned char idx, return 0; #endif - unsigned short __free(kfree) *new_map = kmalloc(sizeof(plain_map), GFP_KERNEL); + unsigned short __free(kfree) *new_map = + kmalloc_array(ARRAY_SIZE(plain_map), sizeof(*new_map), + GFP_KERNEL); if (!new_map) return -ENOMEM; -- 2.34.1
