mmu->l2pts is sized as IPU3_PT_PTES * sizeof(*mmu->l2pts) by hand.
Use vcalloc() instead, which computes the size via the overflow-checked
size_mul() so a large enough count fails the allocation cleanly
instead of silently wrapping size_t into a too-small buffer.

No functional change.

Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com>
---
 drivers/staging/media/ipu3/ipu3-mmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/media/ipu3/ipu3-mmu.c b/drivers/staging/media/ipu3/ipu3-mmu.c
index b196a5815903..ab40502c06b8 100644
--- a/drivers/staging/media/ipu3/ipu3-mmu.c
+++ b/drivers/staging/media/ipu3/ipu3-mmu.c
@@ -464,7 +464,7 @@ struct imgu_mmu_info *imgu_mmu_init(struct device *parent, void __iomem *base)
 	 * Allocate the array of L2PT CPU pointers, initialized to zero,
 	 * which means the dummy L2PT allocated above.
 	 */
-	mmu->l2pts = vzalloc(IPU3_PT_PTES * sizeof(*mmu->l2pts));
+	mmu->l2pts = vcalloc(IPU3_PT_PTES, sizeof(*mmu->l2pts));
 	if (!mmu->l2pts)
 		goto fail_l2pt;