From 3e1f8882a9f2a792f2627e7aac711d42bc809afe Mon Sep 17 00:00:00 2001 From: "Gustavo A. R. Silva" Date: Wed, 29 Jul 2020 18:35:57 -0500 Subject: [PATCH] staging: wfx: Use flex_array_size() helper in memcpy() Make use of the flex_array_size() helper to calculate the size of a flexible array member within an enclosing structure. This helper offers defense-in-depth against potential integer overflows, while at the same time makes it explicitly clear that we are dealing with a flexible array member. Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20200729233557.GA17693@embeddedor Signed-off-by: Greg Kroah-Hartman --- drivers/staging/wfx/hif_tx_mib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/wfx/hif_tx_mib.c b/drivers/staging/wfx/hif_tx_mib.c index 1689cb42acc0..05f1e1e98af9 100644 --- a/drivers/staging/wfx/hif_tx_mib.c +++ b/drivers/staging/wfx/hif_tx_mib.c @@ -113,7 +113,7 @@ int hif_set_beacon_filter_table(struct wfx_vif *wvif, int tbl_len, if (!val) return -ENOMEM; val->num_of_info_elmts = cpu_to_le32(tbl_len); - memcpy(val->ie_table, tbl, tbl_len * sizeof(*tbl)); + memcpy(val->ie_table, tbl, flex_array_size(val, ie_table, tbl_len)); ret = hif_write_mib(wvif->wdev, wvif->id, HIF_MIB_ID_BEACON_FILTER_TABLE, val, buf_len); kfree(val);