From 58901d181f12807d6bfa7ef29547b560740dd305 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 26 Sep 2012 10:21:48 +0300 Subject: [PATCH] brcmfmac: use kcalloc() to prevent integer overflow The multiplication here looks like it could overflow. I've changed it to use kcalloc() to prevent that. Signed-off-by: Dan Carpenter Acked-by: Arend van Spriel Signed-off-by: John W. Linville --- drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c index e40cfe8..24e8f8d 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c @@ -3297,8 +3297,8 @@ brcmf_notify_sched_scan_results(struct brcmf_cfg80211_priv *cfg_priv, int i; request = kzalloc(sizeof(*request), GFP_KERNEL); - ssid = kzalloc(sizeof(*ssid) * result_count, GFP_KERNEL); - channel = kzalloc(sizeof(*channel) * result_count, GFP_KERNEL); + ssid = kcalloc(result_count, sizeof(*ssid), GFP_KERNEL); + channel = kcalloc(result_count, sizeof(*channel), GFP_KERNEL); if (!request || !ssid || !channel) { err = -ENOMEM; goto out_err; -- 2.7.4