From 35a5ab8ef7f0f00b30eab9d917f3f0f4a2bec5d6 Mon Sep 17 00:00:00 2001 From: "Baoli.Zhang" Date: Wed, 6 May 2026 13:50:37 +0800 Subject: [PATCH] soundwire: use krealloc_array to prevent integer overflow Replace the use of krealloc() with krealloc_array() in sdw_add_element_group_count to mitigate the risk of integer overflow during memory allocation size calculation. Suggested-by: Andy Shevchenko Signed-off-by: Baoli.Zhang Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20260506055039.3751028-4-baoli.zhang@linux.intel.com Signed-off-by: Vinod Koul --- drivers/soundwire/generic_bandwidth_allocation.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/soundwire/generic_bandwidth_allocation.c b/drivers/soundwire/generic_bandwidth_allocation.c index cd9ccbaf0e46..3575d69ce1c5 100644 --- a/drivers/soundwire/generic_bandwidth_allocation.c +++ b/drivers/soundwire/generic_bandwidth_allocation.c @@ -308,17 +308,15 @@ static int sdw_add_element_group_count(struct sdw_group *group, unsigned int *rates; unsigned int *lanes; - rates = krealloc(group->rates, - sizeof(int) * (group->max_size + 1), - GFP_KERNEL); + rates = krealloc_array(group->rates, group->max_size + 1, + sizeof(*group->rates), GFP_KERNEL); if (!rates) return -ENOMEM; group->rates = rates; - lanes = krealloc(group->lanes, - sizeof(int) * (group->max_size + 1), - GFP_KERNEL); + lanes = krealloc_array(group->lanes, group->max_size + 1, + sizeof(*group->lanes), GFP_KERNEL); if (!lanes) return -ENOMEM;