Use krealloc_array() for growing the RDS iovector array. This makes the array allocation overflow-safe and derives the element size from the array pointer. Signed-off-by: Weimin Xiong Reviewed-by: Allison Henderson --- net/rds/send.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/rds/send.c b/net/rds/send.c index 68be1bf0e..a567c97a 100644 --- a/net/rds/send.c +++ b/net/rds/send.c @@ -971,11 +971,8 @@ static int rds_rm_size(struct msghdr *msg, int num_sgs, return -EINVAL; if (vct->indx >= vct->len) { vct->len += vct->incr; - tmp_iov = - krealloc(vct->vec, - vct->len * - sizeof(struct rds_iov_vector), - GFP_KERNEL); + tmp_iov = krealloc_array(vct->vec, vct->len, + sizeof(*vct->vec), GFP_KERNEL); if (!tmp_iov) { vct->len -= vct->incr; return -ENOMEM; -- 2.39.3