The formats array is allocated separately with devm_kcalloc() and only referenced through the fimc_context. Make it a flexible array member at the end of the context and allocate both in one go with struct_size().
Annotate it with __counted_by(num_formats) so the array accesses can be bounds checked with FORTIFY_SOURCE and UBSAN_BOUNDS. Assisted-by: LLM Signed-off-by: Rosen Penev <[email protected]> --- drivers/gpu/drm/exynos/exynos_drm_fimc.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c index 09e33a26caaf..079d24d0671c 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c +++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c @@ -99,7 +99,6 @@ struct fimc_context { void *dma_priv; struct device *dev; struct exynos_drm_ipp_task *task; - struct exynos_drm_ipp_formats *formats; unsigned int num_formats; void __iomem *regs; @@ -108,6 +107,7 @@ struct fimc_context { struct fimc_scaler sc; int id; int irq; + struct exynos_drm_ipp_formats formats[] __counted_by(num_formats); }; static u32 fimc_read(struct fimc_context *ctx, u32 reg) @@ -1273,20 +1273,16 @@ static int fimc_probe(struct platform_device *pdev) if (exynos_drm_check_fimc_device(dev) != 0) return -ENODEV; - ctx = devm_kzalloc(dev, sizeof(*ctx), GFP_KERNEL); + num_formats = ARRAY_SIZE(fimc_formats) + ARRAY_SIZE(fimc_tiled_formats); + ctx = devm_kzalloc(dev, struct_size(ctx, formats, num_formats), GFP_KERNEL); if (!ctx) return -ENOMEM; + ctx->num_formats = num_formats; + formats = ctx->formats; ctx->dev = dev; ctx->id = of_alias_get_id(dev->of_node, "fimc"); - /* construct formats/limits array */ - num_formats = ARRAY_SIZE(fimc_formats) + ARRAY_SIZE(fimc_tiled_formats); - formats = devm_kcalloc(dev, num_formats, sizeof(*formats), - GFP_KERNEL); - if (!formats) - return -ENOMEM; - /* linear formats */ if (ctx->id < 3) { limits = fimc_4210_limits_v1; @@ -1320,9 +1316,6 @@ static int fimc_probe(struct platform_device *pdev) formats[j].num_limits = num_limits; } - ctx->formats = formats; - ctx->num_formats = num_formats; - /* resource memory */ ctx->regs = devm_platform_ioremap_resource(pdev, 0); if (IS_ERR(ctx->regs)) -- 2.56.0
