staging: gpib: Fix buffer overflow in ni_usb_init

The writes buffer size was not taking into account the number of
entries in the array which was causing random oopses.

Fixes: 4e127de14fa7 ("staging: gpib: Add National Instruments USB GPIB driver")
Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/20241104175014.12317-2-dpenkler@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
index 571f07800c9a067a26986d3c8f46ceaf62bd2d46..b7550a937f15cb489663debbb330d6bad75844f7 100644 (file)
--- a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
+++ b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
@@ -1726,7 +1726,7 @@ static int ni_usb_init(gpib_board_t *board)
        unsigned int ibsta;
        int writes_len;
 
-       writes = kmalloc(sizeof(*writes), GFP_KERNEL);
+       writes = kmalloc_array(NUM_INIT_WRITES, sizeof(*writes), GFP_KERNEL);
        if (!writes)
                return -ENOMEM;