staging: media: atomisp: use array3_size() for overflow-safe allocation

Browse source

Replace open-coded width * height * sizeof() multiplications with
array3_size() to prevent integer overflow in buffer allocations.

The atomisp driver computes DVS, morphing table, shading table and
statistics buffer sizes using unchecked arithmetic.  When dimensions
are attacker-controlled or simply large, the product can silently wrap,
causing kvmalloc() to allocate an undersized buffer.

array3_size() saturates to SIZE_MAX on overflow, so kvmalloc() returns
NULL instead of succeeding with too few bytes.

Signed-off-by: Feng Ning <feng@innora.ai>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>

...

This commit is contained in:

Feng Ning 2026-04-12 00:05:08 +00:00 • committed by Sakari Ailus

parent 7222dc8751

commit d178c7ca8f

3 changed files with 31 additions and 19 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

11

drivers/staging/media/atomisp/pci/sh_css_param_dvs.c

View file

4

drivers/staging/media/atomisp/pci/sh_css_param_shading.c

View file

35

drivers/staging/media/atomisp/pci/sh_css_params.c

View file