linux-kernel - Re: [PATCH] drm/amd/display: Use kmalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ce6cab60-30e0-429c-bce2-7aa5e5ffc09a@amd.com>
Date: Mon, 15 Sep 2025 22:08:55 -0600
From: Alex Hung <alex.hung@....com>
To: James Flowers <bold.zone2373@...tmail.com>, harry.wentland@....com,
 sunpeng.li@....com, siqueira@...lia.com, alexander.deucher@....com,
 christian.koenig@....com, airlied@...il.com, simona@...ll.ch,
 roman.li@....com, alvin.lee2@....com, skhan@...uxfoundation.org
Cc: amd-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
 linux-kernel@...r.kernel.org, linux-kernel-mentees@...ts.linux.dev
Subject: Re: [PATCH] drm/amd/display: Use kmalloc_array() instead of kmalloc()

Reviewed-by: Alex Hung <alex.hung@....com>

On 9/12/25 23:19, James Flowers wrote:
> Documentation/process/deprecated.rst recommends against the use of kmalloc
> with dynamic size calculations due to the risk of overflow and smaller
> allocation being made than the caller was expecting. This could lead to
> buffer overflow in code similar to the memcpy in
> amdgpu_dm_plane_add_modifier().
> 
> Signed-off-by: James Flowers <bold.zone2373@...tmail.com>
> ---
> I see that in amdgpu_dm_plane_get_plane_modifiers, capacity is initialized to
> only 128, but it is probably preferable to refactor.
>   
> Tested on a Steam Deck OLED with no apparent regressions using these test suites from
> igt-gpu-tools:
> 1) kms_plane
> 2) amd_plane
> 3) amd_fuzzing
> 4) testdisplay
> 
>   drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
> index b7c6e8d13435..b587d2033f0b 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
> @@ -146,7 +146,7 @@ static void amdgpu_dm_plane_add_modifier(uint64_t **mods, uint64_t *size, uint64
>   
>   	if (*cap - *size < 1) {
>   		uint64_t new_cap = *cap * 2;
> -		uint64_t *new_mods = kmalloc(new_cap * sizeof(uint64_t), GFP_KERNEL);
> +		uint64_t *new_mods = kmalloc_array(new_cap, sizeof(uint64_t), GFP_KERNEL);
>   
>   		if (!new_mods) {
>   			kfree(*mods);
> @@ -732,7 +732,7 @@ static int amdgpu_dm_plane_get_plane_modifiers(struct amdgpu_device *adev, unsig
>   	if (adev->family < AMDGPU_FAMILY_AI)
>   		return 0;
>   
> -	*mods = kmalloc(capacity * sizeof(uint64_t), GFP_KERNEL);
> +	*mods = kmalloc_array(capacity, sizeof(uint64_t), GFP_KERNEL);
>   
>   	if (plane_type == DRM_PLANE_TYPE_CURSOR) {
>   		amdgpu_dm_plane_add_modifier(mods, &size, &capacity, DRM_FORMAT_MOD_LINEAR);