[PATCH] vt: keyboard: Allocate new_map with ARRAY_SIZE()

[Kees Cook]

From: Kees Cook <kees+treewide@xxxxxxxxxx>

In preparation for converting the kmalloc family of allocators to the
type-aware kmalloc_obj family, we need to make sure that the returned
type from the allocation matches the type of the variable being
assigned. (The kmalloc family returns "void *", which can be implicitly
cast to any pointer type.)

The new key map has as many entries as plain_map, but the size was taken
from the whole array, which would make the allocation type a pointer to
the array rather than the "unsigned short *" being assigned. Allocate
ARRAY_SIZE-many entries instead. The resulting allocation size is the
same.

Build tested ARCH=x86_64 allmodconfig with GCC 16.2.0:
drivers/tty/vt/keyboard.o

Assisted-by: LLM coccinelle
Signed-off-by: Kees Cook <kees+treewide@xxxxxxxxxx>
---
Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Cc: Jiri Slaby <jirislaby@xxxxxxxxxx>
Cc: Nicolas Pitre <npitre@xxxxxxxxxxxx>
Cc: <linux-serial@xxxxxxxxxxxxxxx>
---
 drivers/tty/vt/keyboard.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index c41d850b29c6..ef4a19aeb3ce 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -2002,7 +2002,9 @@ static int vt_kdskbent(unsigned char kbdmode, unsigned char idx,
 		return 0;
 #endif
 
-	unsigned short __free(kfree) *new_map = kmalloc(sizeof(plain_map), GFP_KERNEL);
+	unsigned short __free(kfree) *new_map =
+		kmalloc_array(ARRAY_SIZE(plain_map), sizeof(*new_map),
+			      GFP_KERNEL);
 	if (!new_map)
 		return -ENOMEM;
 
-- 
2.34.1