From: Weimin Xiong <redacted>
Date: Thu, 16 Jul 2026 10:51:00 +0800
quoted hunk ↗ jump to hunk
Use array_size() when calculating the parser table allocation size so an
overflow in the firmware-provided item dimensions is detected before
allocation. Include the overflow helpers explicitly instead of relying on
an indirect include.
Signed-off-by: Weimin Xiong <redacted>
---
diff --git a/drivers/net/ethernet/intel/ice/ice_parser.c b/drivers/net/ethernet/intel/ice/ice_parser.c
index f8e69630f..c109d3c32 100644
--- a/drivers/net/ethernet/intel/ice/ice_parser.c
+++ b/drivers/net/ethernet/intel/ice/ice_parser.c
@@ -1,6 +1,8 @@
// SPDX-License-Identifier: GPL-2.0
/* Copyright (C) 2024 Intel Corporation */
+#include <linux/overflow.h>
This is redundant.
quoted hunk ↗ jump to hunk
+
#include "ice_common.h"
struct ice_pkg_sect_hdr {@@ -102,7 +104,7 @@ ice_parser_create_table(struct ice_hw *hw, u32 sect_type,
if (!seg)
return ERR_PTR(-EINVAL);
- table = kzalloc(item_size * length, GFP_KERNEL);
+ table = kzalloc(array_size(item_size, length), GFP_KERNEL);
kcalloc(length, item_size) if you want to make it _proper_.
array_size() is used only when no array allocation helpers are
available, e.g. for dma_alloc_coherent(). For regular slab allocations,
we have a whole bunch of different array allocation helpers.
if (!table)
return ERR_PTR(-ENOMEM);
Thanks,
Olek