Re: [PATCH] net: atlantic: Use kmalloc_array to prevent overflow of dynamic size calculation

[Bhanu Seshu Kumar Valluri <bhanuseshukumar@gmail.com>]

On 30/09/25 17:47, Eric Dumazet wrote:
> On Tue, Sep 30, 2025 at 4:39 AM bhanuseshukumar
> <bhanuseshukumar@gmail.com> wrote:
>>
>> On 30/09/25 16:54, Sahil Chandna wrote:
>>> On 30/09/2025 16:49, Bhanu Seshu Kumar Valluri wrote:
>>>> Use kmalloc_array to avoid potential overflow during dynamic size calculation
>>>> inside kmalloc.
>>>>
>>>> Signed-off-by: Bhanu Seshu Kumar Valluri <bhanuseshukumar@gmail.com>
>>>> ---
>>>>   Note: Patch is tested for compilation.
>>>>   drivers/net/ethernet/aquantia/atlantic/aq_ptp.c | 2 +-
>>>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>>>
>>>> diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c
>>>> index 5acb3e16b567..f445d449f80f 100644
>>>> --- a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c
>>>> +++ b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c
>>>> @@ -182,7 +182,7 @@ static unsigned int aq_ptp_skb_buf_len(struct ptp_skb_ring *ring)
>>>>     static int aq_ptp_skb_ring_init(struct ptp_skb_ring *ring, unsigned int size)
>>>>   {
>>>> -    struct sk_buff **buff = kmalloc(sizeof(*buff) * size, GFP_KERNEL);
>>>> +    struct sk_buff **buff = kmalloc_array(sizeof(*buff), size, GFP_KERNEL);
>>>>
>>> Shouldn't this be kmalloc_array(size, sizeof(*buff), GFP_KERNEL); ?
>>
>> I didn't change the order of arguments to make it easier to review.
> 
> I think this NIC limits the number of skbs per queue to less than 8192.
> 
> Also sizeof(struct sk_buff *) is quite small (a pointer is 8 or 4 bytes)
> 
> So your patch would probably target net-next as a cleanup, in about
> two weeks when the merge window is over.
> 
> More details in
> https://www.kernel.org/doc/Documentation/process/maintainer-netdev.rst
> 
> Thanks.

Thank you for sharing helpful documentation. I will send a cleanup patch designated with net-next once
net-next reopens.

Thanks.