Re: [PATCH] staging: media: atomisp: prefer kcalloc over kzalloc with multiply

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Ignored memory allocation failure leads to null-equivalent pointer passed to SP firmware.
--

commit 967be0a2dfa51f2c0edc88c4aa3976bc41aab85d
Author: Andrew Soto <linux@notrealandy.dev>

staging: media: atomisp: prefer kcalloc over kzalloc with multiply

This commit replaces a raw multiplication inside kzalloc() with a kcalloc()
array allocation in sh_css_params.c. This validates the array size
calculations to prevent potential integer overflow vulnerabilities before
interacting with the kernel heap allocator.

> diff --git a/drivers/staging/media/atomisp/pci/sh_css_params.c b/drivers/staging/media/atomisp/pci/sh_css_params.c
> index fcebace11daf6..9147ca0474ad2 100644
> --- a/drivers/staging/media/atomisp/pci/sh_css_params.c
> +++ b/drivers/staging/media/atomisp/pci/sh_css_params.c
> @@ -3716,7 +3716,7 @@ ia_css_ptr sh_css_store_sp_group_to_ddr(void)
>  
>  	IA_CSS_ENTER_LEAVE_PRIVATE("void");
>  
> -	write_buf = kzalloc(sizeof(u8) * 8192, GFP_KERNEL);
> +	write_buf = kcalloc(8192, sizeof(u8), GFP_KERNEL);
>  	if (!write_buf)
>  		return 0;

[Severity: High]
This isn't a bug introduced by this patch, but is it possible that this early
return causes the firmware to crash under memory pressure?

If kcalloc() fails, sh_css_store_sp_group_to_ddr() returns 0, which acts as
a null-equivalent for an ia_css_ptr.

Looking at the caller in drivers/staging/media/atomisp/pci/sh_css_sp.c:

store_sp_group_data() {
    ...
    per_frame_data.sp_group_addr = sh_css_store_sp_group_to_ddr();
    ...
}

The return value is unconditionally assigned to per_frame_data.sp_group_addr
without any validation. When this 0 is sent directly to the per-frame
hardware configuration, will the SP firmware crash or lock up the hardware
when attempting to access address 0 for its group configuration?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260606234427.9902-1-linux@notrealandy.dev?part=1