* [PATCH v2 1/3] staging: media: atomisp: use kvmalloc_objs() in make_histogram()
2026-06-22 22:42 [PATCH v2 0/3] staging: media: atomisp: use kvmalloc_objs() and drop redundant OOM messages Rodrigo Gobbi
@ 2026-06-22 22:42 ` Rodrigo Gobbi
2026-06-22 22:42 ` [PATCH v2 2/3] staging: media: atomisp: use kvmalloc_objs() for overflow-safe allocation Rodrigo Gobbi
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Rodrigo Gobbi @ 2026-06-22 22:42 UTC (permalink / raw)
To: andy, hansg, mchehab, sakari.ailus, gregkh
Cc: ~lkcamp/patches, linux-kernel-mentees, linux-kernel, linux-media,
linux-staging
Replace kvmalloc() with multiply with kvmalloc_objs(), which handles
the size multiplication internally with overflow checking, silenting
checkpatch warn.
Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
---
drivers/staging/media/atomisp/pci/sh_css_metrics.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css_metrics.c b/drivers/staging/media/atomisp/pci/sh_css_metrics.c
index edf473dd86ca..90d92ab8d52b 100644
--- a/drivers/staging/media/atomisp/pci/sh_css_metrics.c
+++ b/drivers/staging/media/atomisp/pci/sh_css_metrics.c
@@ -4,6 +4,8 @@
* Copyright (c) 2015, Intel Corporation.
*/
+#include <linux/slab.h>
+
#include "assert_support.h"
#include "sh_css_metrics.h"
@@ -59,16 +61,13 @@ make_histogram(struct sh_css_pc_histogram *histogram, unsigned int length)
return;
if (histogram->run)
return;
- histogram->run = kvmalloc(length * sizeof(*histogram->run),
- GFP_KERNEL);
+ histogram->run = kvmalloc_objs(*histogram->run, length);
if (!histogram->run)
return;
- histogram->stall = kvmalloc(length * sizeof(*histogram->stall),
- GFP_KERNEL);
+ histogram->stall = kvmalloc_objs(*histogram->stall, length);
if (!histogram->stall)
return;
- histogram->msink = kvmalloc(length * sizeof(*histogram->msink),
- GFP_KERNEL);
+ histogram->msink = kvmalloc_objs(*histogram->msink, length);
if (!histogram->msink)
return;
--
2.48.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH v2 2/3] staging: media: atomisp: use kvmalloc_objs() for overflow-safe allocation
2026-06-22 22:42 [PATCH v2 0/3] staging: media: atomisp: use kvmalloc_objs() and drop redundant OOM messages Rodrigo Gobbi
2026-06-22 22:42 ` [PATCH v2 1/3] staging: media: atomisp: use kvmalloc_objs() in make_histogram() Rodrigo Gobbi
@ 2026-06-22 22:42 ` Rodrigo Gobbi
2026-06-23 10:22 ` Andy Shevchenko
2026-06-22 22:42 ` [PATCH v2 3/3] staging: media: atomisp: drop redundant out-of-memory messages Rodrigo Gobbi
2026-06-23 9:29 ` [PATCH v2 0/3] staging: media: atomisp: use kvmalloc_objs() and drop redundant OOM messages Andy Shevchenko
3 siblings, 1 reply; 6+ messages in thread
From: Rodrigo Gobbi @ 2026-06-22 22:42 UTC (permalink / raw)
To: andy, hansg, mchehab, sakari.ailus, gregkh
Cc: ~lkcamp/patches, linux-kernel-mentees, linux-kernel, linux-media,
linux-staging
Several allocations in sh_css_params.c still size their buffers with
open-coded multiplication (e.g. width * height * sizeof(*p)), which can
silently overflow and under-allocate.
Convert them to kvmalloc_objs() with array_size(), which saturate to
SIZE_MAX on overflow so kvmalloc() returns NULL instead of allocating
too few bytes.
Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
---
.../staging/media/atomisp/pci/sh_css_params.c | 101 +++++++-----------
1 file changed, 36 insertions(+), 65 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css_params.c b/drivers/staging/media/atomisp/pci/sh_css_params.c
index 8420a22fd8f0..50dbda6b3f0a 100644
--- a/drivers/staging/media/atomisp/pci/sh_css_params.c
+++ b/drivers/staging/media/atomisp/pci/sh_css_params.c
@@ -6,6 +6,7 @@
#include <linux/overflow.h>
#include <linux/math.h>
+#include <linux/slab.h>
#include "gdc_device.h" /* gdc_lut_store(), ... */
#include "isp.h" /* ISP_VEC_ELEMBITS */
@@ -4151,7 +4152,6 @@ struct ia_css_3a_statistics *
ia_css_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid)
{
struct ia_css_3a_statistics *me;
- int grid_size;
IA_CSS_ENTER("grid=%p", grid);
@@ -4162,8 +4162,8 @@ ia_css_3a_statistics_allocate(const struct ia_css_3a_grid_info *grid)
goto err;
me->grid = *grid;
- grid_size = grid->width * grid->height;
- me->data = kvmalloc(grid_size * sizeof(*me->data), GFP_KERNEL);
+ me->data = kvmalloc_objs(*me->data,
+ array_size(grid->width, grid->height));
if (!me->data)
goto err;
/* No weighted histogram, no structure, treat the histogram data as a byte dump in a byte array */
@@ -4245,15 +4245,15 @@ ia_css_dvs_coefficients_allocate(const struct ia_css_dvs_grid_info *grid)
me->grid = *grid;
- me->hor_coefs = kvmalloc(grid->num_hor_coefs *
- IA_CSS_DVS_NUM_COEF_TYPES *
- sizeof(*me->hor_coefs), GFP_KERNEL);
+ me->hor_coefs = kvmalloc_objs(*me->hor_coefs,
+ array_size(grid->num_hor_coefs,
+ IA_CSS_DVS_NUM_COEF_TYPES));
if (!me->hor_coefs)
goto err;
- me->ver_coefs = kvmalloc(grid->num_ver_coefs *
- IA_CSS_DVS_NUM_COEF_TYPES *
- sizeof(*me->ver_coefs), GFP_KERNEL);
+ me->ver_coefs = kvmalloc_objs(*me->ver_coefs,
+ array_size(grid->num_ver_coefs,
+ IA_CSS_DVS_NUM_COEF_TYPES));
if (!me->ver_coefs)
goto err;
@@ -4277,6 +4277,7 @@ struct ia_css_dvs2_statistics *
ia_css_dvs2_statistics_allocate(const struct ia_css_dvs_grid_info *grid)
{
struct ia_css_dvs2_statistics *me;
+ size_t cnt;
assert(grid);
@@ -4286,59 +4287,37 @@ ia_css_dvs2_statistics_allocate(const struct ia_css_dvs_grid_info *grid)
me->grid = *grid;
- me->hor_prod.odd_real = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->hor_prod.odd_real),
- GFP_KERNEL);
+ cnt = array_size(grid->aligned_width, grid->aligned_height);
+
+ me->hor_prod.odd_real = kvmalloc_objs(*me->hor_prod.odd_real, cnt);
if (!me->hor_prod.odd_real)
goto err;
- me->hor_prod.odd_imag = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->hor_prod.odd_imag),
- GFP_KERNEL);
+ me->hor_prod.odd_imag = kvmalloc_objs(*me->hor_prod.odd_imag, cnt);
if (!me->hor_prod.odd_imag)
goto err;
- me->hor_prod.even_real = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->hor_prod.even_real),
- GFP_KERNEL);
+ me->hor_prod.even_real = kvmalloc_objs(*me->hor_prod.even_real, cnt);
if (!me->hor_prod.even_real)
goto err;
- me->hor_prod.even_imag = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->hor_prod.even_imag),
- GFP_KERNEL);
+ me->hor_prod.even_imag = kvmalloc_objs(*me->hor_prod.even_imag, cnt);
if (!me->hor_prod.even_imag)
goto err;
- me->ver_prod.odd_real = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->ver_prod.odd_real),
- GFP_KERNEL);
+ me->ver_prod.odd_real = kvmalloc_objs(*me->ver_prod.odd_real, cnt);
if (!me->ver_prod.odd_real)
goto err;
- me->ver_prod.odd_imag = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->ver_prod.odd_imag),
- GFP_KERNEL);
+ me->ver_prod.odd_imag = kvmalloc_objs(*me->ver_prod.odd_imag, cnt);
if (!me->ver_prod.odd_imag)
goto err;
- me->ver_prod.even_real = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->ver_prod.even_real),
- GFP_KERNEL);
+ me->ver_prod.even_real = kvmalloc_objs(*me->ver_prod.even_real, cnt);
if (!me->ver_prod.even_real)
goto err;
- me->ver_prod.even_imag = kvmalloc(grid->aligned_width *
- grid->aligned_height *
- sizeof(*me->ver_prod.even_imag),
- GFP_KERNEL);
+ me->ver_prod.even_imag = kvmalloc_objs(*me->ver_prod.even_imag, cnt);
if (!me->ver_prod.even_imag)
goto err;
@@ -4377,51 +4356,43 @@ ia_css_dvs2_coefficients_allocate(const struct ia_css_dvs_grid_info *grid)
me->grid = *grid;
- me->hor_coefs.odd_real = kvmalloc(grid->num_hor_coefs *
- sizeof(*me->hor_coefs.odd_real),
- GFP_KERNEL);
+ me->hor_coefs.odd_real = kvmalloc_objs(*me->hor_coefs.odd_real,
+ grid->num_hor_coefs);
if (!me->hor_coefs.odd_real)
goto err;
- me->hor_coefs.odd_imag = kvmalloc(grid->num_hor_coefs *
- sizeof(*me->hor_coefs.odd_imag),
- GFP_KERNEL);
+ me->hor_coefs.odd_imag = kvmalloc_objs(*me->hor_coefs.odd_imag,
+ grid->num_hor_coefs);
if (!me->hor_coefs.odd_imag)
goto err;
- me->hor_coefs.even_real = kvmalloc(grid->num_hor_coefs *
- sizeof(*me->hor_coefs.even_real),
- GFP_KERNEL);
+ me->hor_coefs.even_real = kvmalloc_objs(*me->hor_coefs.even_real,
+ grid->num_hor_coefs);
if (!me->hor_coefs.even_real)
goto err;
- me->hor_coefs.even_imag = kvmalloc(grid->num_hor_coefs *
- sizeof(*me->hor_coefs.even_imag),
- GFP_KERNEL);
+ me->hor_coefs.even_imag = kvmalloc_objs(*me->hor_coefs.even_imag,
+ grid->num_hor_coefs);
if (!me->hor_coefs.even_imag)
goto err;
- me->ver_coefs.odd_real = kvmalloc(grid->num_ver_coefs *
- sizeof(*me->ver_coefs.odd_real),
- GFP_KERNEL);
+ me->ver_coefs.odd_real = kvmalloc_objs(*me->ver_coefs.odd_real,
+ grid->num_ver_coefs);
if (!me->ver_coefs.odd_real)
goto err;
- me->ver_coefs.odd_imag = kvmalloc(grid->num_ver_coefs *
- sizeof(*me->ver_coefs.odd_imag),
- GFP_KERNEL);
+ me->ver_coefs.odd_imag = kvmalloc_objs(*me->ver_coefs.odd_imag,
+ grid->num_ver_coefs);
if (!me->ver_coefs.odd_imag)
goto err;
- me->ver_coefs.even_real = kvmalloc(grid->num_ver_coefs *
- sizeof(*me->ver_coefs.even_real),
- GFP_KERNEL);
+ me->ver_coefs.even_real = kvmalloc_objs(*me->ver_coefs.even_real,
+ grid->num_ver_coefs);
if (!me->ver_coefs.even_real)
goto err;
- me->ver_coefs.even_imag = kvmalloc(grid->num_ver_coefs *
- sizeof(*me->ver_coefs.even_imag),
- GFP_KERNEL);
+ me->ver_coefs.even_imag = kvmalloc_objs(*me->ver_coefs.even_imag,
+ grid->num_ver_coefs);
if (!me->ver_coefs.even_imag)
goto err;
--
2.48.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v2 2/3] staging: media: atomisp: use kvmalloc_objs() for overflow-safe allocation
2026-06-22 22:42 ` [PATCH v2 2/3] staging: media: atomisp: use kvmalloc_objs() for overflow-safe allocation Rodrigo Gobbi
@ 2026-06-23 10:22 ` Andy Shevchenko
0 siblings, 0 replies; 6+ messages in thread
From: Andy Shevchenko @ 2026-06-23 10:22 UTC (permalink / raw)
To: Rodrigo Gobbi
Cc: andy, hansg, mchehab, sakari.ailus, gregkh, ~lkcamp/patches,
linux-kernel-mentees, linux-kernel, linux-media, linux-staging
On Mon, Jun 22, 2026 at 07:42:43PM -0300, Rodrigo Gobbi wrote:
> Several allocations in sh_css_params.c still size their buffers with
> open-coded multiplication (e.g. width * height * sizeof(*p)), which can
> silently overflow and under-allocate.
>
> Convert them to kvmalloc_objs() with array_size(), which saturate to
> SIZE_MAX on overflow so kvmalloc() returns NULL instead of allocating
> too few bytes.
...
> + me->hor_coefs = kvmalloc_objs(*me->hor_coefs,
> + array_size(grid->num_hor_coefs,
> + IA_CSS_DVS_NUM_COEF_TYPES));
Here and elsewhere with long line, do like you have done in one case
with a temporary variable cnt. It makes same number of lines of code,
but readability is better.
> if (!me->hor_coefs)
> goto err;
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2 3/3] staging: media: atomisp: drop redundant out-of-memory messages
2026-06-22 22:42 [PATCH v2 0/3] staging: media: atomisp: use kvmalloc_objs() and drop redundant OOM messages Rodrigo Gobbi
2026-06-22 22:42 ` [PATCH v2 1/3] staging: media: atomisp: use kvmalloc_objs() in make_histogram() Rodrigo Gobbi
2026-06-22 22:42 ` [PATCH v2 2/3] staging: media: atomisp: use kvmalloc_objs() for overflow-safe allocation Rodrigo Gobbi
@ 2026-06-22 22:42 ` Rodrigo Gobbi
2026-06-23 9:29 ` [PATCH v2 0/3] staging: media: atomisp: use kvmalloc_objs() and drop redundant OOM messages Andy Shevchenko
3 siblings, 0 replies; 6+ messages in thread
From: Rodrigo Gobbi @ 2026-06-22 22:42 UTC (permalink / raw)
To: andy, hansg, mchehab, sakari.ailus, gregkh
Cc: ~lkcamp/patches, linux-kernel-mentees, linux-kernel, linux-media,
linux-staging
On allocation failure the memory management core already emits a detailed
warning so driver's own IA_CSS_ERROR("out of memory") lines add nothing but noise.
Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
---
drivers/staging/media/atomisp/pci/sh_css_param_dvs.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css_param_dvs.c b/drivers/staging/media/atomisp/pci/sh_css_param_dvs.c
index ad2a9b84e232..c0102056d421 100644
--- a/drivers/staging/media/atomisp/pci/sh_css_param_dvs.c
+++ b/drivers/staging/media/atomisp/pci/sh_css_param_dvs.c
@@ -25,7 +25,6 @@ alloc_dvs_6axis_table(const struct ia_css_resolution *frame_res,
dvs_config = kvmalloc_obj(struct ia_css_dvs_6axis_config);
if (!dvs_config) {
- IA_CSS_ERROR("out of memory");
err = -ENOMEM;
} else {
/*Initialize new struct with latest config settings*/
@@ -52,7 +51,6 @@ alloc_dvs_6axis_table(const struct ia_css_resolution *frame_res,
dvs_config->xcoords_y = kvmalloc(array3_size(width_y, height_y, sizeof(uint32_t)),
GFP_KERNEL);
if (!dvs_config->xcoords_y) {
- IA_CSS_ERROR("out of memory");
err = -ENOMEM;
goto exit;
}
@@ -60,7 +58,6 @@ alloc_dvs_6axis_table(const struct ia_css_resolution *frame_res,
dvs_config->ycoords_y = kvmalloc(array3_size(width_y, height_y, sizeof(uint32_t)),
GFP_KERNEL);
if (!dvs_config->ycoords_y) {
- IA_CSS_ERROR("out of memory");
err = -ENOMEM;
goto exit;
}
@@ -72,7 +69,6 @@ alloc_dvs_6axis_table(const struct ia_css_resolution *frame_res,
sizeof(uint32_t)),
GFP_KERNEL);
if (!dvs_config->xcoords_uv) {
- IA_CSS_ERROR("out of memory");
err = -ENOMEM;
goto exit;
}
@@ -81,7 +77,6 @@ alloc_dvs_6axis_table(const struct ia_css_resolution *frame_res,
sizeof(uint32_t)),
GFP_KERNEL);
if (!dvs_config->ycoords_uv) {
- IA_CSS_ERROR("out of memory");
err = -ENOMEM;
}
exit:
--
2.48.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v2 0/3] staging: media: atomisp: use kvmalloc_objs() and drop redundant OOM messages
2026-06-22 22:42 [PATCH v2 0/3] staging: media: atomisp: use kvmalloc_objs() and drop redundant OOM messages Rodrigo Gobbi
` (2 preceding siblings ...)
2026-06-22 22:42 ` [PATCH v2 3/3] staging: media: atomisp: drop redundant out-of-memory messages Rodrigo Gobbi
@ 2026-06-23 9:29 ` Andy Shevchenko
3 siblings, 0 replies; 6+ messages in thread
From: Andy Shevchenko @ 2026-06-23 9:29 UTC (permalink / raw)
To: Rodrigo Gobbi
Cc: andy, hansg, mchehab, sakari.ailus, gregkh, ~lkcamp/patches,
linux-kernel-mentees, linux-kernel, linux-media, linux-staging
On Mon, Jun 22, 2026 at 07:42:41PM -0300, Rodrigo Gobbi wrote:
> Several allocations in the atomisp driver still size their buffers with
> open-coded multiplication, e.g. width * height * sizeof(*p). When the
> dimensions are large the product can silently wrap, causing kvmalloc()
> to allocate an undersized buffer.
>
> Convert the remaining sites to kvmalloc_objs() with array_size(), which
> saturate to SIZE_MAX on overflow so kvmalloc() returns NULL instead of
> allocating too few bytes.
>
> This continues the work started in commit [2], and picks up the stalled
> sites from [1], unifying with [3].
>
> While here, drop the redundant IA_CSS_ERROR("out of memory") messages on
> the touched allocation paths: the memory management core already emits a
> far more detailed warning on allocation failure as raised at [1].
> [1] https://lore.kernel.org/all/20260413112904.98864-1-feng@innora.ai/
> [2] https://github.com/torvalds/linux/commit/d178c7ca8fefc28115d35b94c3b1f4d653e34182
> [3] https://lore.kernel.org/all/20260609215110.118860-1-rodrigo.gobbi.7@gmail.com/
> ---
> Hi, all,
> Regarding a comment from Andy at [3]:
> > There is a ongoing effort like this for other files from atomisp
> > at [1], yet, it is not covering the same file.
> > [1] https://lore.kernel.org/all/20260413112904.98864-1-feng@innora.ai/
>
> > Yeah, the problem is that the activity seems stale. Can you pickup all
> > the patches from the mailing list that have not been yet applied (regarding
> > k*alloc() uses) and combine them into series or so and update regarding to
> > Sakari's comments?
> The only patches that I found from stale threads were added in this series,
> hope that is fine now.
You need to preserve the original authors.
Also see individual comments.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 6+ messages in thread