usb: atm: Use struct_size() helper

Make use of the struct_size() helper instead of an open-coded version,
in order to avoid any potential type mistakes or integer overflows that,
in the worse scenario, could lead to heap overflows.

Link: https://github.com/KSPP/linux/issues/160
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/20210928233935.GA299525@embeddedor
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
index 33ae03ac13a687e389f3babc7e9b3e49175705c1..da17be1ef64e277c387efe1abf8112638e7d76e6 100644 (file)
--- a/drivers/usb/atm/usbatm.c
+++ b/drivers/usb/atm/usbatm.c
@@ -1015,9 +1015,11 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
        int error = -ENOMEM;
        int i, length;
        unsigned int maxpacket, num_packets;
+       size_t size;
 
        /* instance init */
-       instance = kzalloc(sizeof(*instance) + sizeof(struct urb *) * (num_rcv_urbs + num_snd_urbs), GFP_KERNEL);
+       size = struct_size(instance, urbs, num_rcv_urbs + num_snd_urbs);
+       instance = kzalloc(size, GFP_KERNEL);
        if (!instance)
                return -ENOMEM;