Re: [PATCH v3 2/3] staging: media: atomisp: use kvmalloc_objs() for overflow-safe allocation

Andy Shevchenko <[email protected]> Thu, 25 Jun 2026 10:14:04 +0300

Newsgroups	dev.linux.lists.linux-kernel-mentees,dev.linux.lists.linux-staging,org.kernel.vger.linux-kernel,org.kernel.vger.linux-media
Organization	Intel Finland Oy - BIC 0357606-4 - c/o Alberga Business Park, 6 krs, Bertel Jungin Aukio 5, 02600 Espoo
Message-ID	<[email protected]>

On Tue, Jun 23, 2026 at 07:09:27PM -0300, Rodrigo Gobbi wrote:

> Replace open-coded width * height * sizeof() multiplications with
> kvmalloc_objs() and array_size() to prevent integer overflow in buffer
> allocations.
> 
> The atomisp driver computes DVS and statistics buffer sizes using
> unchecked arithmetic.  When dimensions are large, the product can
> silently wrap, causing kvmalloc() to allocate an undersized buffer.
> 
> kvmalloc_objs() uses size_mul() internally, which saturates to SIZE_MAX
> on overflow, so kvmalloc() returns NULL instead of succeeding with too
> few bytes.  array_size() provides the same overflow protection for the
> two-factor dimension products.
> 
> Suggested-by: Andy Shevchenko <[email protected]>
> Signed-off-by: Feng Ning <[email protected]>

> [rodrigo: rebased; convert only the sites left open-coded after
>    commit d178c7ca8fef]

Thanks, you can keep this on a single line

[rodrigo: rebased; convert only the sites left open-coded after commit d178c7ca8fef]

> Signed-off-by: Rodrigo Gobbi <[email protected]>

-- 
With Best Regards,
Andy Shevchenko