Re: [PATCH] drivers/bluetooth: btbcm: Use kmalloc_array() to prevent overflow

[Ayaan Mirza Baig <ayaanmirzabaig85@gmail.com>]

On Tue, Nov 11, 2025 at 04:20:14PM +0100, Paul Menzel wrote:
> > Replace the open-coded multiplication in kmalloc() with a call
> > to kmalloc_array() to prevent potential integer overflows.
> 
> Excuse my ignorance, how would that overflow happen? How is the generated
> code different?

Hi Paul,

The compiler firstly calculates the size then calles kmalloc().
If BCM_FW_NAME_COUNT_MAX and BCM_FW_NAME_LEN are two large unsigned numbers,
their product can le larget than SIZE_T_MAX, this then leads to it wrapping
to a modulo of SIZE_T_MAX.

kmalloc() then gets called with this tiny, wrapped size.
It allocates a small buffer, and the when the code is executed further,
believing it has a large buffer, writes past the end of the tiny buffer
causing a heap buffer overflow.


> I’d add a dot/period at the end of the sentence.

Thanks! I'll keep that in mind for the future.

Regards,
Ayaan Mirza Baig

---
P.S. By the way, I'm a second year engineering student and
I apologize for any stupid-ish thing I might have done.
Also I would love to learn from my mistakes, any tips and pointers are highly appreciated.