From: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
To: andy@kernel.org, hansg@kernel.org, mchehab@kernel.org,
sakari.ailus@linux.intel.com, gregkh@linuxfoundation.org
Cc: ~lkcamp/patches@lists.sr.ht,
linux-kernel-mentees@lists.linux.dev,
linux-kernel@vger.kernel.org, linux-media@vger.kernel.org,
linux-staging@lists.linux.dev
Subject: [PATCH v2 2/3] staging: media: atomisp: use kvmalloc_objs() for overflow-safe allocation
Date: Mon, 22 Jun 2026 19:42:43 -0300 [thread overview]
Message-ID: <20260622224402.34001-3-rodrigo.gobbi.7@gmail.com> (raw)
In-Reply-To: <20260622224402.34001-1-rodrigo.gobbi.7@gmail.com>
Several allocations in sh_css_params.c still size their buffers with
open-coded multiplication (e.g. width * height * sizeof(*p)), which can
silently overflow and under-allocate.
Convert them to kvmalloc_objs() with array_size(), which saturate to
SIZE_MAX on overflow so kvmalloc() returns NULL instead of allocating
too few bytes.
Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
---
.../staging/media/atomisp/pci/sh_css_params.c | 101 +++++++-----------
1 file changed, 36 insertions(+), 65 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css_params.c b/drivers/staging/media/atomisp/pci/sh_css_params.c
index 8420a22fd8f0..50dbda6b3f0a 100644
--- a/drivers/staging/media/atomisp/pci/sh_css_params.c
+++ b/drivers/staging/media/atomisp/pci/sh_css_params.c
@@ -6,6 +6,7 @@
#include <linux/overflow.h>
#include <linux/math.h>
+#include <linux/slab.h>
#include "gdc_device.h" /* gdc_lut_store(), ... */
#include "isp.h" /* ISP_VEC_ELEMBITS */
@@ -4151,7 +4152,6 @@ struct ia_css_3a_statistics *
ia_css_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid)
{
struct ia_css_3a_statistics *me;
- int grid_size;
IA_CSS_ENTER("grid=%p", grid);
@@ -4162,8 +4162,8 @@ ia_css_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid)
goto err;
me->grid = *grid;
- grid_size = grid->width * grid->height;
- me->data = kvmalloc(grid_size * sizeof(*me->data), GFP_KERNEL);
+ me->data = kvmalloc_objs(*me->data,
+ array_size(grid->width, grid->height));
if (!me->data)
goto err;
/* No weighted histogram, no structure, treat the histogram data as a byte dump in a byte array */
@@ -4245,15 +4245,15 @@ ia_css_dvs_coefficients_allocate(const struct ia_css_dvs_grid_info *grid)
me->grid = *grid;
- me->hor_coefs = kvmalloc(grid->num_hor_coefs *
- IA_CSS_DVS_NUM_COEF_TYPES *
- sizeof(*me->hor_coefs), GFP_KERNEL);
+ me->hor_coefs = kvmalloc_objs(*me->hor_coefs,
+ array_size(grid->num_hor_coefs,
+ IA_CSS_DVS_NUM_COEF_TYPES));
if (!me->hor_coefs)
goto err;
- me->ver_coefs = kvmalloc(grid->num_ver_coefs *
- IA_CSS_DVS_NUM_COEF_TYPES *
- sizeof(*me->ver_coefs), GFP_KERNEL);
+ me->ver_coefs = kvmalloc_objs(*me->ver_coefs,
+ array_size(grid->num_ver_coefs,
+ IA_CSS_DVS_NUM_COEF_TYPES));
if (!me->ver_coefs)
goto err;
@@ -4277,6 +4277,7 @@ struct ia_css_dvs2_statistics *
ia_css_dvs2_statistics_allocate(const struct ia_css_dvs_grid_info *grid)
{
struct ia_css_dvs2_statistics *me;
+ size_t cnt;
assert(grid);
@@ -4286,59 +4287,37 @@ ia_css_dvs2_statistics_allocate(const struct ia_css_dvs_grid_info *grid)
me->grid = *grid;
- me->hor_prod.odd_real = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->hor_prod.odd_real),
- GFP_KERNEL);
+ cnt = array_size(grid->aligned_width, grid->aligned_height);
+
+ me->hor_prod.odd_real = kvmalloc_objs(*me->hor_prod.odd_real, cnt);
if (!me->hor_prod.odd_real)
goto err;
- me->hor_prod.odd_imag = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->hor_prod.odd_imag),
- GFP_KERNEL);
+ me->hor_prod.odd_imag = kvmalloc_objs(*me->hor_prod.odd_imag, cnt);
if (!me->hor_prod.odd_imag)
goto err;
- me->hor_prod.even_real = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->hor_prod.even_real),
- GFP_KERNEL);
+ me->hor_prod.even_real = kvmalloc_objs(*me->hor_prod.even_real, cnt);
if (!me->hor_prod.even_real)
goto err;
- me->hor_prod.even_imag = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->hor_prod.even_imag),
- GFP_KERNEL);
+ me->hor_prod.even_imag = kvmalloc_objs(*me->hor_prod.even_imag, cnt);
if (!me->hor_prod.even_imag)
goto err;
- me->ver_prod.odd_real = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->ver_prod.odd_real),
- GFP_KERNEL);
+ me->ver_prod.odd_real = kvmalloc_objs(*me->ver_prod.odd_real, cnt);
if (!me->ver_prod.odd_real)
goto err;
- me->ver_prod.odd_imag = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->ver_prod.odd_imag),
- GFP_KERNEL);
+ me->ver_prod.odd_imag = kvmalloc_objs(*me->ver_prod.odd_imag, cnt);
if (!me->ver_prod.odd_imag)
goto err;
- me->ver_prod.even_real = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->ver_prod.even_real),
- GFP_KERNEL);
+ me->ver_prod.even_real = kvmalloc_objs(*me->ver_prod.even_real, cnt);
if (!me->ver_prod.even_real)
goto err;
- me->ver_prod.even_imag = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->ver_prod.even_imag),
- GFP_KERNEL);
+ me->ver_prod.even_imag = kvmalloc_objs(*me->ver_prod.even_imag, cnt);
if (!me->ver_prod.even_imag)
goto err;
@@ -4377,51 +4356,43 @@ ia_css_dvs2_coefficients_allocate(const struct ia_css_dvs_grid_info *grid)
me->grid = *grid;
- me->hor_coefs.odd_real = kvmalloc(grid->num_hor_coefs *
- sizeof(*me->hor_coefs.odd_real),
- GFP_KERNEL);
+ me->hor_coefs.odd_real = kvmalloc_objs(*me->hor_coefs.odd_real,
+ grid->num_hor_coefs);
if (!me->hor_coefs.odd_real)
goto err;
- me->hor_coefs.odd_imag = kvmalloc(grid->num_hor_coefs *
- sizeof(*me->hor_coefs.odd_imag),
- GFP_KERNEL);
+ me->hor_coefs.odd_imag = kvmalloc_objs(*me->hor_coefs.odd_imag,
+ grid->num_hor_coefs);
if (!me->hor_coefs.odd_imag)
goto err;
- me->hor_coefs.even_real = kvmalloc(grid->num_hor_coefs *
- sizeof(*me->hor_coefs.even_real),
- GFP_KERNEL);
+ me->hor_coefs.even_real = kvmalloc_objs(*me->hor_coefs.even_real,
+ grid->num_hor_coefs);
if (!me->hor_coefs.even_real)
goto err;
- me->hor_coefs.even_imag = kvmalloc(grid->num_hor_coefs *
- sizeof(*me->hor_coefs.even_imag),
- GFP_KERNEL);
+ me->hor_coefs.even_imag = kvmalloc_objs(*me->hor_coefs.even_imag,
+ grid->num_hor_coefs);
if (!me->hor_coefs.even_imag)
goto err;
- me->ver_coefs.odd_real = kvmalloc(grid->num_ver_coefs *
- sizeof(*me->ver_coefs.odd_real),
- GFP_KERNEL);
+ me->ver_coefs.odd_real = kvmalloc_objs(*me->ver_coefs.odd_real,
+ grid->num_ver_coefs);
if (!me->ver_coefs.odd_real)
goto err;
- me->ver_coefs.odd_imag = kvmalloc(grid->num_ver_coefs *
- sizeof(*me->ver_coefs.odd_imag),
- GFP_KERNEL);
+ me->ver_coefs.odd_imag = kvmalloc_objs(*me->ver_coefs.odd_imag,
+ grid->num_ver_coefs);
if (!me->ver_coefs.odd_imag)
goto err;
- me->ver_coefs.even_real = kvmalloc(grid->num_ver_coefs *
- sizeof(*me->ver_coefs.even_real),
- GFP_KERNEL);
+ me->ver_coefs.even_real = kvmalloc_objs(*me->ver_coefs.even_real,
+ grid->num_ver_coefs);
if (!me->ver_coefs.even_real)
goto err;
- me->ver_coefs.even_imag = kvmalloc(grid->num_ver_coefs *
- sizeof(*me->ver_coefs.even_imag),
- GFP_KERNEL);
+ me->ver_coefs.even_imag = kvmalloc_objs(*me->ver_coefs.even_imag,
+ grid->num_ver_coefs);
if (!me->ver_coefs.even_imag)
goto err;
--
2.48.1
next prev parent reply other threads:[~2026-06-22 22:44 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-22 22:42 [PATCH v2 0/3] staging: media: atomisp: use kvmalloc_objs() and drop redundant OOM messages Rodrigo Gobbi
2026-06-22 22:42 ` [PATCH v2 1/3] staging: media: atomisp: use kvmalloc_objs() in make_histogram() Rodrigo Gobbi
2026-06-22 22:42 ` Rodrigo Gobbi [this message]
2026-06-23 10:22 ` [PATCH v2 2/3] staging: media: atomisp: use kvmalloc_objs() for overflow-safe allocation Andy Shevchenko
2026-06-22 22:42 ` [PATCH v2 3/3] staging: media: atomisp: drop redundant out-of-memory messages Rodrigo Gobbi
2026-06-23 9:29 ` [PATCH v2 0/3] staging: media: atomisp: use kvmalloc_objs() and drop redundant OOM messages Andy Shevchenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260622224402.34001-3-rodrigo.gobbi.7@gmail.com \
--to=rodrigo.gobbi.7@gmail.com \
--cc=andy@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=hansg@kernel.org \
--cc=linux-kernel-mentees@lists.linux.dev \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-staging@lists.linux.dev \
--cc=mchehab@kernel.org \
--cc=sakari.ailus@linux.intel.com \
--cc=~lkcamp/patches@lists.sr.ht \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox