diff options
| author | Ayaan Mirza Baig <ayaanmirzabaig85@gmail.com> | 2025-11-11 19:50:41 +0530 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2025-12-01 16:21:16 -0500 |
| commit | 6f7cf13ef6b0fe2bdd539e5aa1b1fc8a1213cfc3 (patch) | |
| tree | f01e14a1c53aa123fa134beb40cf0e22c8bc7e6c | |
| parent | bc6f557b3387d807e08ffb8d638f149fedb75bf6 (diff) | |
drivers/bluetooth: btbcm: Use kmalloc_array() to prevent overflow
Replace the open-coded multiplication in kmalloc() with a call
to kmalloc_array() to prevent potential integer overflows.
This is a mechanical change, replacing BCM_FW_NAME_LEN with
the type-safe sizeof(*fw_name) as the element size
Signed-off-by: Ayaan Mirza Baig <ayaanmirzabaig85@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
| -rw-r--r-- | drivers/bluetooth/btbcm.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c index 3a3a56ddbb06..d33cc70eec66 100644 --- a/drivers/bluetooth/btbcm.c +++ b/drivers/bluetooth/btbcm.c @@ -642,7 +642,9 @@ int btbcm_initialize(struct hci_dev *hdev, bool *fw_load_done, bool use_autobaud snprintf(postfix, sizeof(postfix), "-%4.4x-%4.4x", vid, pid); } - fw_name = kmalloc(BCM_FW_NAME_COUNT_MAX * BCM_FW_NAME_LEN, GFP_KERNEL); + fw_name = kmalloc_array(BCM_FW_NAME_COUNT_MAX, + sizeof(*fw_name), + GFP_KERNEL); if (!fw_name) return -ENOMEM; |