From nobody Fri Apr 3 20:51:51 2026 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6DDD5399003 for ; Mon, 23 Mar 2026 12:11:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.16 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774267871; cv=none; b=NH8s/yJcGwWyMCznbczLQ5kcm9UWc2IB4di9MYRrEsyClldhUL72cyN6M48yFC0UUQVq9ISpbxYuNdhCIfuQ26Z+H2Anfg6GHT9lIS1HBGo0fBg1fxqlAMNQ9do8h9qTnoShdkryNE2l9qm7Zqjnsr8b0hStjorV7oHsX9M0uRU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774267871; c=relaxed/simple; bh=MAIabYMZDm4pt0yXUI0+YbcdPcR2pRhl6gfJJ9j3YqM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=sduXuRKHPYu32DTj5qX6DB0OFqtzEyDBJzK64AniEzxD4ALmMIJAFa5H9zTbM1P0oW54a4d3v+oIwUa7CiHUxCwDl2i9Nhl11Nffl7BG8XBn9IsH45i2pjmtIbwAUQURZx55x9FhqKe0wDeTebWbI7YEftjt2MFCXXOBuOw+97I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Pi3eas9C; arc=none smtp.client-ip=198.175.65.16 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Pi3eas9C" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1774267871; x=1805803871; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=MAIabYMZDm4pt0yXUI0+YbcdPcR2pRhl6gfJJ9j3YqM=; b=Pi3eas9CWNZh/izEuJTFY3NWG+6bgzbb3tmb3HKQmvLSn0taJJul9qVf o6yPRQfPT7WqWml//pbJN7EfiBt6FrfS8FktbQ5cSA/w5TzZHVobJo8Uz b/aQIDVT6q7LYipQtvVBLdehEhy08xn+EQ6NmAAJaeXUHmKU+YZP2gclB YO1Md9WLgcp6gIjEN6N4X/9wQxEtZkVcPsGvm0nU4timUw5cmOeUtlFeB 0A13aicwTNUM8o4yo4xVU2Ei2Qdo5IE6GYfPrc0rHLfAnKFthRbPqSzBs OgauT/FNzjTOi1k9at+9yQrgdb0SMJX0JS++pcIRIIqLZDiPlJSZXiKWa Q==; X-CSE-ConnectionGUID: P8Xb1cb3R3+qSImuPOq1yQ== X-CSE-MsgGUID: E7q9zBoJTyCM3bNQ5iIjBg== X-IronPort-AV: E=McAfee;i="6800,10657,11737"; a="75454599" X-IronPort-AV: E=Sophos;i="6.23,137,1770624000"; d="scan'208";a="75454599" Received: from orviesa003.jf.intel.com ([10.64.159.143]) by orvoesa108.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Mar 2026 05:11:10 -0700 X-CSE-ConnectionGUID: mmF30YyhQaqSbF1hN9k8ow== X-CSE-MsgGUID: fBiM4LulS3yjca7nX6M1sw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.23,137,1770624000"; d="scan'208";a="228083714" Received: from emr-371.sh.intel.com ([10.67.116.154]) by ORVIESA003-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Mar 2026 05:11:08 -0700 From: "Baoli.Zhang" To: Matthew Brost , =?UTF-8?q?Thomas=20Hellstr=C3=B6m?= , Rodrigo Vivi , David Airlie , Simona Vetter , intel-xe@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Cc: "Baoli.Zhang" , "Junxiao . Chang" Subject: [PATCH v1] drm/xe: use krealloc_array to prevent integer overflow Date: Mon, 23 Mar 2026 20:00:49 +0800 Message-ID: <20260323120051.983301-1-baoli.zhang@linux.intel.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Replace the use of krealloc() with krealloc_array() in xe driver to mitigate the risk of integer overflow during memory allocation size calculation. Signed-off-by: Baoli.Zhang Signed-off-by: Junxiao.Chang --- drivers/gpu/drm/xe/xe_configfs.c | 2 +- drivers/gpu/drm/xe/xe_vm_madvise.c | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/xe/xe_configfs.c b/drivers/gpu/drm/xe/xe_confi= gfs.c index 7fd07d1280bb1..4cf903c904ba0 100644 --- a/drivers/gpu/drm/xe/xe_configfs.c +++ b/drivers/gpu/drm/xe/xe_configfs.c @@ -766,7 +766,7 @@ static ssize_t wa_bb_store(struct wa_bb wa_bb[static XE= _ENGINE_CLASS_MAX], * 2. Allocate a u32 array and set the pointers to the right positions * according to the length of each class' wa_bb */ - tmp =3D krealloc(wa_bb[0].cs, count * sizeof(u32), GFP_KERNEL); + tmp =3D krealloc_array(wa_bb[0].cs, count, sizeof(u32), GFP_KERNEL); if (!tmp) return -ENOMEM; =20 diff --git a/drivers/gpu/drm/xe/xe_vm_madvise.c b/drivers/gpu/drm/xe/xe_vm_= madvise.c index bc39a9a9790c3..82afe4bef0725 100644 --- a/drivers/gpu/drm/xe/xe_vm_madvise.c +++ b/drivers/gpu/drm/xe/xe_vm_madvise.c @@ -63,8 +63,9 @@ static int get_vmas(struct xe_vm *vm, struct xe_vmas_in_m= advise_range *madvise_r =20 if (madvise_range->num_vmas =3D=3D max_vmas) { max_vmas <<=3D 1; - __vmas =3D krealloc(madvise_range->vmas, - max_vmas * sizeof(*madvise_range->vmas), + __vmas =3D krealloc_array(madvise_range->vmas, + max_vmas, + sizeof(*madvise_range->vmas), GFP_KERNEL); if (!__vmas) { kfree(madvise_range->vmas); --=20 2.43.0