Documentation/process/deprecated.rst recommends against the use of
kmalloc with dynamic size calculations due to the risk of overflow and
smaller allocation being made than the caller was expecting.

Replace kmalloc() with kmalloc_array() in drivers/gpu/drm/tiny/repaper.c
to make the intended allocation size clearer and avoid potential overflow
issues.

Signed-off-by: Rahul Kumar <rk0006818@gmail.com>
---
 drivers/gpu/drm/tiny/repaper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/tiny/repaper.c b/drivers/gpu/drm/tiny/repaper.c
index 5c3b51eb0a97..4d439a2d973a 100644
--- a/drivers/gpu/drm/tiny/repaper.c
+++ b/drivers/gpu/drm/tiny/repaper.c
@@ -535,7 +535,7 @@ static int repaper_fb_dirty(struct drm_framebuffer *fb,
 	DRM_DEBUG("Flushing [FB:%d] st=%ums\n", fb->base.id,
 		  epd->factored_stage_time);
 
-	buf = kmalloc(fb->width * fb->height / 8, GFP_KERNEL);
+	buf = kmalloc_array(fb->width, fb->height / 8, GFP_KERNEL);
 	if (!buf) {
 		ret = -ENOMEM;
 		goto out_exit;
-- 
2.43.0

On Tue, 23 Sep 2025, Rahul Kumar <rk0006818@gmail.com> wrote:
> Documentation/process/deprecated.rst recommends against the use of
> kmalloc with dynamic size calculations due to the risk of overflow and
> smaller allocation being made than the caller was expecting.
>
> Replace kmalloc() with kmalloc_array() in drivers/gpu/drm/tiny/repaper.c
> to make the intended allocation size clearer and avoid potential overflow
> issues.
>
> Signed-off-by: Rahul Kumar <rk0006818@gmail.com>
> ---
>  drivers/gpu/drm/tiny/repaper.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/tiny/repaper.c b/drivers/gpu/drm/tiny/repaper.c
> index 5c3b51eb0a97..4d439a2d973a 100644
> --- a/drivers/gpu/drm/tiny/repaper.c
> +++ b/drivers/gpu/drm/tiny/repaper.c
> @@ -535,7 +535,7 @@ static int repaper_fb_dirty(struct drm_framebuffer *fb,
>  	DRM_DEBUG("Flushing [FB:%d] st=%ums\n", fb->base.id,
>  		  epd->factored_stage_time);
>  
> -	buf = kmalloc(fb->width * fb->height / 8, GFP_KERNEL);
> +	buf = kmalloc_array(fb->width, fb->height / 8, GFP_KERNEL);

That's just not the same thing, though.

BR,
Jani.

>  	if (!buf) {
>  		ret = -ENOMEM;
>  		goto out_exit;

-- 
Jani Nikula, Intel

On Tue, Sep 23, 2025 at 7:21 PM Jani Nikula <jani.nikula@linux.intel.com> wrote:
>
> On Tue, 23 Sep 2025, Rahul Kumar <rk0006818@gmail.com> wrote:
> > Documentation/process/deprecated.rst recommends against the use of
> > kmalloc with dynamic size calculations due to the risk of overflow and
> > smaller allocation being made than the caller was expecting.
> >
> > Replace kmalloc() with kmalloc_array() in drivers/gpu/drm/tiny/repaper.c
> > to make the intended allocation size clearer and avoid potential overflow
> > issues.
> >
> > Signed-off-by: Rahul Kumar <rk0006818@gmail.com>
> > ---
> >  drivers/gpu/drm/tiny/repaper.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/tiny/repaper.c b/drivers/gpu/drm/tiny/repaper.c
> > index 5c3b51eb0a97..4d439a2d973a 100644
> > --- a/drivers/gpu/drm/tiny/repaper.c
> > +++ b/drivers/gpu/drm/tiny/repaper.c
> > @@ -535,7 +535,7 @@ static int repaper_fb_dirty(struct drm_framebuffer *fb,
> >       DRM_DEBUG("Flushing [FB:%d] st=%ums\n", fb->base.id,
> >                 epd->factored_stage_time);
> >
> > -     buf = kmalloc(fb->width * fb->height / 8, GFP_KERNEL);
> > +     buf = kmalloc_array(fb->width, fb->height / 8, GFP_KERNEL);
>
> That's just not the same thing, though.
>

Thanks Jani, you are right. My change made the allocation size
different from the original (width * height / 8). The current code is
fine, so I will not change it.

Thanks,
Rahul


> BR,
> Jani.
>
> >       if (!buf) {
> >               ret = -ENOMEM;
> >               goto out_exit;
>
> --
> Jani Nikula, Intel