diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c index 6034cd8992b0..2492b339d049 100644 --- a/drivers/soc/qcom/mdt_loader.c +++ b/drivers/soc/qcom/mdt_loader.c @@ -107,6 +107,10 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len) ehdr_size = phdrs[0].p_filesz; hash_size = phdrs[1].p_filesz; + /* Overflow check */ + if (ehdr_size > SIZE_MAX - hash_size) + return ERR_PTR(-ENOMEM); + data = kmalloc(ehdr_size + hash_size, GFP_KERNEL); if (!data) return ERR_PTR(-ENOMEM);