| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20250817092942.95053-1-rongqianfeng@vivo.com>
Date: Sun, 17 Aug 2025 17:29:39 +0800
From: Qianfeng Rong <rongqianfeng@...o.com>
To: Andy Shevchenko <andy@...nel.org>,
Hans de Goede <hansg@...nel.org>,
Mauro Carvalho Chehab <mchehab@...nel.org>,
Sakari Ailus <sakari.ailus@...ux.intel.com>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Qianfeng Rong <rongqianfeng@...o.com>,
Colin Ian King <colin.i.king@...il.com>,
linux-kernel@...r.kernel.org,
linux-media@...r.kernel.org,
linux-staging@...ts.linux.dev
Subject: [PATCH] media: atomisp: use kmalloc_array() for array space allocation
Replace kmalloc(count * sizeof) with kmalloc_array() for safer memory
allocation and overflow prevention.
Signed-off-by: Qianfeng Rong <rongqianfeng@...o.com>
---
drivers/staging/media/atomisp/pci/sh_css.c | 52 +++++++++++-----------
1 file changed, 27 insertions(+), 25 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css.c b/drivers/staging/media/atomisp/pci/sh_css.c
index 73bd87f43a8c..f7ce2872ced7 100644
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c
@@ -5821,36 +5821,37 @@ static int ia_css_pipe_create_cas_scaler_desc_single_output(
i *= max_scale_factor_per_stage;
}
- descr->in_info = kmalloc(descr->num_stage *
- sizeof(struct ia_css_frame_info),
- GFP_KERNEL);
+ descr->in_info = kmalloc_array(descr->num_stage,
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->in_info) {
err = -ENOMEM;
goto ERR;
}
- descr->internal_out_info = kmalloc(descr->num_stage *
- sizeof(struct ia_css_frame_info),
- GFP_KERNEL);
+ descr->internal_out_info = kmalloc_array(descr->num_stage,
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->internal_out_info) {
err = -ENOMEM;
goto ERR;
}
- descr->out_info = kmalloc(descr->num_stage *
- sizeof(struct ia_css_frame_info),
- GFP_KERNEL);
+ descr->out_info = kmalloc_array(descr->num_stage,
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->out_info) {
err = -ENOMEM;
goto ERR;
}
- descr->vf_info = kmalloc(descr->num_stage *
- sizeof(struct ia_css_frame_info),
- GFP_KERNEL);
+ descr->vf_info = kmalloc_array(descr->num_stage,
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->vf_info) {
err = -ENOMEM;
goto ERR;
}
- descr->is_output_stage = kmalloc(descr->num_stage * sizeof(bool),
- GFP_KERNEL);
+ descr->is_output_stage = kmalloc_array(descr->num_stage,
+ sizeof(bool),
+ GFP_KERNEL);
if (!descr->is_output_stage) {
err = -ENOMEM;
goto ERR;
@@ -5977,29 +5978,30 @@ ia_css_pipe_create_cas_scaler_desc(struct ia_css_pipe *pipe,
err = -ENOMEM;
goto ERR;
}
- descr->internal_out_info = kmalloc(descr->num_stage *
- sizeof(struct ia_css_frame_info),
- GFP_KERNEL);
+ descr->internal_out_info = kmalloc_array(descr->num_stage,
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->internal_out_info) {
err = -ENOMEM;
goto ERR;
}
- descr->out_info = kmalloc(descr->num_stage *
- sizeof(struct ia_css_frame_info),
- GFP_KERNEL);
+ descr->out_info = kmalloc_array(descr->num_stage,
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->out_info) {
err = -ENOMEM;
goto ERR;
}
- descr->vf_info = kmalloc(descr->num_stage *
- sizeof(struct ia_css_frame_info),
- GFP_KERNEL);
+ descr->vf_info = kmalloc_array(descr->num_stage,
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->vf_info) {
err = -ENOMEM;
goto ERR;
}
- descr->is_output_stage = kmalloc(descr->num_stage * sizeof(bool),
- GFP_KERNEL);
+ descr->is_output_stage = kmalloc_array(descr->num_stage,
+ sizeof(bool),
+ GFP_KERNEL);
if (!descr->is_output_stage) {
err = -ENOMEM;
goto ERR;
--
2.34.1
Powered by blists - more mailing lists