[<prev] [next>] [day] [month] [year] [list]
Message-Id: <20251002022241.77823-1-bhanuseshukumar@gmail.com>
Date: Thu, 2 Oct 2025 07:52:41 +0530
From: Bhanu Seshu Kumar Valluri <bhanuseshukumar@...il.com>
To: Alex Deucher <alexander.deucher@....com>,
Christian König <christian.koenig@....com>,
David Airlie <airlied@...il.com>,
Simona Vetter <simona@...ll.ch>,
Harry Wentland <harry.wentland@....com>,
Leo Li <sunpeng.li@....com>,
Rodrigo Siqueira <siqueira@...lia.com>,
Tao Zhou <tao.zhou1@....com>,
Hawking Zhang <Hawking.Zhang@....com>,
ganglxie <ganglxie@....com>,
Lijo Lazar <lijo.lazar@....com>,
Candice Li <candice.li@....com>,
Victor Skvortsov <victor.skvortsov@....com>,
Roman Li <roman.li@....com>,
Alvin Lee <Alvin.Lee2@....com>,
Karthi Kandasamy <karthi.kandasamy@....com>,
David Rosca <david.rosca@....com>,
Marek Olšák <marek.olsak@....com>,
Jocelyn Falempe <jfalempe@...hat.com>,
André Almeida <andrealmeid@...lia.com>,
Mario Limonciello <mario.limonciello@....com>
Cc: amd-gfx@...ts.freedesktop.org,
dri-devel@...ts.freedesktop.org,
linux-kernel@...r.kernel.org,
khalid@...nel.org,
linux-kernel-mentees@...ts.linuxfoundation.org,
skhan@...uxfoundation.org,
david.hunter.linux@...il.com,
bhanuseshukumar@...il.com
Subject: [PATCH] drm: amd: Use kmalloc_array to prevent overflow of dynamic size calculation
Use kmalloc_array to avoid potential overflow during dynamic size calculation
inside kmalloc.
Signed-off-by: Bhanu Seshu Kumar Valluri <bhanuseshukumar@...il.com>
---
Note:
Patch is verified for compilation.
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 4 ++--
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index 540817e296da..642addf70466 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -2566,7 +2566,7 @@ static int amdgpu_ras_badpages_read(struct amdgpu_device *adev,
goto out;
}
- *bps = kmalloc(sizeof(struct ras_badpage) * data->count, GFP_KERNEL);
+ *bps = kmalloc_array(sizeof(struct ras_badpage), data->count, GFP_KERNEL);
if (!*bps) {
ret = -ENOMEM;
goto out;
@@ -2722,7 +2722,7 @@ static int amdgpu_ras_realloc_eh_data_space(struct amdgpu_device *adev,
unsigned int old_space = data->count + data->space_left;
unsigned int new_space = old_space + pages;
unsigned int align_space = ALIGN(new_space, 512);
- void *bps = kmalloc(align_space * sizeof(*data->bps), GFP_KERNEL);
+ void *bps = kmalloc_array(align_space, sizeof(*data->bps), GFP_KERNEL);
if (!bps) {
return -ENOMEM;
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
index 3d2f8eedeef2..e027798ece03 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
@@ -146,7 +146,7 @@ static void amdgpu_dm_plane_add_modifier(uint64_t **mods, uint64_t *size, uint64
if (*cap - *size < 1) {
uint64_t new_cap = *cap * 2;
- uint64_t *new_mods = kmalloc(new_cap * sizeof(uint64_t), GFP_KERNEL);
+ uint64_t *new_mods = kmalloc_array(new_cap, sizeof(uint64_t), GFP_KERNEL);
if (!new_mods) {
kfree(*mods);
@@ -732,7 +732,7 @@ static int amdgpu_dm_plane_get_plane_modifiers(struct amdgpu_device *adev, unsig
if (adev->family < AMDGPU_FAMILY_AI)
return 0;
- *mods = kmalloc(capacity * sizeof(uint64_t), GFP_KERNEL);
+ *mods = kmalloc_array(capacity, sizeof(uint64_t), GFP_KERNEL);
if (plane_type == DRM_PLANE_TYPE_CURSOR) {
amdgpu_dm_plane_add_modifier(mods, &size, &capacity, DRM_FORMAT_MOD_LINEAR);
--
2.34.1
Powered by blists - more mailing lists