[PATCH] media: atomisp: use kmalloc_array() for array space allocation
From: Qianfeng Rong <hidden>
Date: 2025-08-17 09:29:54
Also in:
linux-media, lkml
Subsystem:
intel mid (mobile internet device) platform, media input infrastructure (v4l/dvb), staging - atomisp driver, staging subsystem, the rest · Maintainers:
Andy Shevchenko, Mauro Carvalho Chehab, Hans de Goede, Greg Kroah-Hartman, Linus Torvalds
Replace kmalloc(count * sizeof) with kmalloc_array() for safer memory allocation and overflow prevention. Signed-off-by: Qianfeng Rong <redacted> --- drivers/staging/media/atomisp/pci/sh_css.c | 52 +++++++++++----------- 1 file changed, 27 insertions(+), 25 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/sh_css.c b/drivers/staging/media/atomisp/pci/sh_css.c
index 73bd87f43a8c..f7ce2872ced7 100644
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c@@ -5821,36 +5821,37 @@ static int ia_css_pipe_create_cas_scaler_desc_single_output( i *= max_scale_factor_per_stage; } - descr->in_info = kmalloc(descr->num_stage * - sizeof(struct ia_css_frame_info), - GFP_KERNEL); + descr->in_info = kmalloc_array(descr->num_stage, + sizeof(struct ia_css_frame_info), + GFP_KERNEL); if (!descr->in_info) { err = -ENOMEM; goto ERR; } - descr->internal_out_info = kmalloc(descr->num_stage * - sizeof(struct ia_css_frame_info), - GFP_KERNEL); + descr->internal_out_info = kmalloc_array(descr->num_stage, + sizeof(struct ia_css_frame_info), + GFP_KERNEL); if (!descr->internal_out_info) { err = -ENOMEM; goto ERR; } - descr->out_info = kmalloc(descr->num_stage * - sizeof(struct ia_css_frame_info), - GFP_KERNEL); + descr->out_info = kmalloc_array(descr->num_stage, + sizeof(struct ia_css_frame_info), + GFP_KERNEL); if (!descr->out_info) { err = -ENOMEM; goto ERR; } - descr->vf_info = kmalloc(descr->num_stage * - sizeof(struct ia_css_frame_info), - GFP_KERNEL); + descr->vf_info = kmalloc_array(descr->num_stage, + sizeof(struct ia_css_frame_info), + GFP_KERNEL); if (!descr->vf_info) { err = -ENOMEM; goto ERR; } - descr->is_output_stage = kmalloc(descr->num_stage * sizeof(bool), - GFP_KERNEL); + descr->is_output_stage = kmalloc_array(descr->num_stage, + sizeof(bool), + GFP_KERNEL); if (!descr->is_output_stage) { err = -ENOMEM; goto ERR;
@@ -5977,29 +5978,30 @@ ia_css_pipe_create_cas_scaler_desc(struct ia_css_pipe *pipe, err = -ENOMEM; goto ERR; } - descr->internal_out_info = kmalloc(descr->num_stage * - sizeof(struct ia_css_frame_info), - GFP_KERNEL); + descr->internal_out_info = kmalloc_array(descr->num_stage, + sizeof(struct ia_css_frame_info), + GFP_KERNEL); if (!descr->internal_out_info) { err = -ENOMEM; goto ERR; } - descr->out_info = kmalloc(descr->num_stage * - sizeof(struct ia_css_frame_info), - GFP_KERNEL); + descr->out_info = kmalloc_array(descr->num_stage, + sizeof(struct ia_css_frame_info), + GFP_KERNEL); if (!descr->out_info) { err = -ENOMEM; goto ERR; } - descr->vf_info = kmalloc(descr->num_stage * - sizeof(struct ia_css_frame_info), - GFP_KERNEL); + descr->vf_info = kmalloc_array(descr->num_stage, + sizeof(struct ia_css_frame_info), + GFP_KERNEL); if (!descr->vf_info) { err = -ENOMEM; goto ERR; } - descr->is_output_stage = kmalloc(descr->num_stage * sizeof(bool), - GFP_KERNEL); + descr->is_output_stage = kmalloc_array(descr->num_stage, + sizeof(bool), + GFP_KERNEL); if (!descr->is_output_stage) { err = -ENOMEM; goto ERR;
--
2.34.1