media: pvrusb2: Use kmemdup_array instead of kmemdup for multiple allocation

Let the kmemdup_array() take care about multiplication
and possible overflows.

Using kmemdup_array() is more appropriate and makes the code
easier to audit.

Signed-off-by: Shen Lichuan <shenlichuan@vivo.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>

diff --git a/drivers/media/usb/pvrusb2/pvrusb2-io.c b/drivers/media/usb/pvrusb2/pvrusb2-io.c
index 675dc7153e2bec4de5eadabfcf208f78a10943c1..28ffe7981f8cc8b1f593e23a833df4b53f6f2401 100644 (file)
--- a/drivers/media/usb/pvrusb2/pvrusb2-io.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-io.c
@@ -335,8 +335,8 @@ static int pvr2_stream_buffer_count(struct pvr2_stream *sp, unsigned int cnt)
                if (scnt < sp->buffer_slot_count) {
                        struct pvr2_buffer **nb = NULL;
                        if (scnt) {
-                               nb = kmemdup(sp->buffers, scnt * sizeof(*nb),
-                                            GFP_KERNEL);
+                               nb = kmemdup_array(sp->buffers, scnt, sizeof(*nb),
+                                                  GFP_KERNEL);
                                if (!nb) return -ENOMEM;
                        }
                        kfree(sp->buffers);