From: Ayaan Mirza Baig Date: Tue, 11 Nov 2025 14:20:41 +0000 (+0530) Subject: drivers/bluetooth: btbcm: Use kmalloc_array() to prevent overflow X-Git-Url: https://gentwo.org/gitweb/?a=commitdiff_plain;h=6f7cf13ef6b0fe2bdd539e5aa1b1fc8a1213cfc3;p=linux%2F.git drivers/bluetooth: btbcm: Use kmalloc_array() to prevent overflow Replace the open-coded multiplication in kmalloc() with a call to kmalloc_array() to prevent potential integer overflows. This is a mechanical change, replacing BCM_FW_NAME_LEN with the type-safe sizeof(*fw_name) as the element size Signed-off-by: Ayaan Mirza Baig Signed-off-by: Luiz Augusto von Dentz --- diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c index 3a3a56ddbb06..d33cc70eec66 100644 --- a/drivers/bluetooth/btbcm.c +++ b/drivers/bluetooth/btbcm.c @@ -642,7 +642,9 @@ int btbcm_initialize(struct hci_dev *hdev, bool *fw_load_done, bool use_autobaud snprintf(postfix, sizeof(postfix), "-%4.4x-%4.4x", vid, pid); } - fw_name = kmalloc(BCM_FW_NAME_COUNT_MAX * BCM_FW_NAME_LEN, GFP_KERNEL); + fw_name = kmalloc_array(BCM_FW_NAME_COUNT_MAX, + sizeof(*fw_name), + GFP_KERNEL); if (!fw_name) return -ENOMEM;