[PATCH v3] media: atomisp: replace kmalloc() with kmalloc_objs() in sh_css.c

[PATCH v3] media: atomisp: replace kmalloc() with kmalloc_objs() in sh_css.c

[Andrei Khomenkov]

Replace arithmetic in the kmalloc() function with the kmalloc_objs()
macro, as this calculation method is unsafe.

Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Andrei Khomenkov <khomenkov@mailbox.org>
---
v3:
 - use 'kmalloc_objs()' macro instead of 'kmalloc_array()' function
 - drop unused 'GFP_KERNEL' arguments since they are default
v2:
 - use 'sizeof(*ptr)' instead of explicit type
 
v2: https://lore.kernel.org/linux-staging/20260613110712.71436-1-khomenkov@mailbox.org/
v1: https://lore.kernel.org/linux-staging/20260606095410.13968-1-khomenkov@mailbox.org/

 drivers/staging/media/atomisp/pci/sh_css.c | 34 ++++++----------------
 1 file changed, 9 insertions(+), 25 deletions(-)

diff --git a/drivers/staging/media/atomisp/pci/sh_css.c b/drivers/staging/media/atomisp/pci/sh_css.c
index 6cda5925fa45..0733d33101b2 100644
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c
@@ -5819,36 +5819,27 @@ static int ia_css_pipe_create_cas_scaler_desc_single_output(
 		i *= max_scale_factor_per_stage;
 	}
 
-	descr->in_info = kmalloc(descr->num_stage *
-				 sizeof(struct ia_css_frame_info),
-				 GFP_KERNEL);
+	kmalloc_objs(descr->in_info, descr->num_stage);
 	if (!descr->in_info) {
 		err = -ENOMEM;
 		goto ERR;
 	}
-	descr->internal_out_info = kmalloc(descr->num_stage *
-					   sizeof(struct ia_css_frame_info),
-					   GFP_KERNEL);
+	kmalloc_objs(descr->internal_out_info, descr->num_stage);
 	if (!descr->internal_out_info) {
 		err = -ENOMEM;
 		goto ERR;
 	}
-	descr->out_info = kmalloc(descr->num_stage *
-				  sizeof(struct ia_css_frame_info),
-				  GFP_KERNEL);
+	kmalloc_objs(descr->out_info, descr->num_stage);
 	if (!descr->out_info) {
 		err = -ENOMEM;
 		goto ERR;
 	}
-	descr->vf_info = kmalloc(descr->num_stage *
-				 sizeof(struct ia_css_frame_info),
-				 GFP_KERNEL);
+	kmalloc_objs(descr->vf_info, descr->num_stage);
 	if (!descr->vf_info) {
 		err = -ENOMEM;
 		goto ERR;
 	}
-	descr->is_output_stage = kmalloc(descr->num_stage * sizeof(bool),
-					 GFP_KERNEL);
+	kmalloc_objs(descr->is_output_stage, descr->num_stage);
 	if (!descr->is_output_stage) {
 		err = -ENOMEM;
 		goto ERR;
@@ -5974,29 +5965,22 @@ ia_css_pipe_create_cas_scaler_desc(struct ia_css_pipe *pipe,
 		err = -ENOMEM;
 		goto ERR;
 	}
-	descr->internal_out_info = kmalloc(descr->num_stage *
-					   sizeof(struct ia_css_frame_info),
-					   GFP_KERNEL);
+	kmalloc_objs(descr->internal_out_info, descr->num_stage);
 	if (!descr->internal_out_info) {
 		err = -ENOMEM;
 		goto ERR;
 	}
-	descr->out_info = kmalloc(descr->num_stage *
-				  sizeof(struct ia_css_frame_info),
-				  GFP_KERNEL);
+	kmalloc_objs(descr->out_info, descr->num_stage);
 	if (!descr->out_info) {
 		err = -ENOMEM;
 		goto ERR;
 	}
-	descr->vf_info = kmalloc(descr->num_stage *
-				 sizeof(struct ia_css_frame_info),
-				 GFP_KERNEL);
+	kmalloc_objs(descr->vf_info, descr->num_stage);
 	if (!descr->vf_info) {
 		err = -ENOMEM;
 		goto ERR;
 	}
-	descr->is_output_stage = kmalloc(descr->num_stage * sizeof(bool),
-					 GFP_KERNEL);
+	kmalloc_objs(descr->is_output_stage, descr->num_stage);
 	if (!descr->is_output_stage) {
 		err = -ENOMEM;
 		goto ERR;

Re: [PATCH v3] media: atomisp: replace kmalloc() with kmalloc_objs() in sh_css.c

[Dan Carpenter]

On Mon, Jun 15, 2026 at 10:45:48PM +0300, Andrei Khomenkov wrote:
> Replace arithmetic in the kmalloc() function with the kmalloc_objs()
> macro, as this calculation method is unsafe.
> 
> Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
> Signed-off-by: Andrei Khomenkov <khomenkov@mailbox.org>
> ---

Are you working against the devel-next tree?  This doesn't apply to
linux-next.

regards,
dan carpenter

Re: [PATCH v3] media: atomisp: replace kmalloc() with kmalloc_objs() in sh_css.c

[Andy Shevchenko]

On Mon, Jun 15, 2026 at 10:45:48PM +0300, Andrei Khomenkov wrote:
> Replace arithmetic in the kmalloc() function with the kmalloc_objs()
> macro, as this calculation method is unsafe.

...

> Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>

Nope, I haven't suggested the initial idea.

...

What about patches that were sent against this driver for the past year?
There were at least two patches of the similar changes. Please, check on
the prior work and if needed rebased, updated, upstreamed.

(If you haven't taken that, it has to be explained why.)

https://lore.kernel.org will help you and
https://lore.kernel.org/linux-media/?q=s%3Aatomisp+b%3Akmalloc
as a rough first step.

-- 
With Best Regards,
Andy Shevchenko