Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

mtdchar: use kvmalloc() for potentially large allocations

mtdchar_write_ioctl() calls kmalloc() with the 'size' argument set to
the smaller of two values: the write request's data/OOB length provided
by user space and the erase block size of the MTD device. If the latter
is large, kmalloc() may not be able to serve such allocation requests.
Use kvmalloc() instead. Correspondingly, replace kfree() calls with
kvfree() calls.

Suggested-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Michał Kępień <kernel@kempniu.pl>
Acked-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20220516070601.11428-3-kernel@kempniu.pl

authored by

Michał Kępień and committed by
Miquel Raynal
83208e10 a1eda864

+5 -5
+5 -5
drivers/mtd/mtdchar.c
··· 623 623 624 624 datbuf_len = min_t(size_t, req.len, mtd->erasesize); 625 625 if (datbuf_len > 0) { 626 - datbuf = kmalloc(datbuf_len, GFP_KERNEL); 626 + datbuf = kvmalloc(datbuf_len, GFP_KERNEL); 627 627 if (!datbuf) 628 628 return -ENOMEM; 629 629 } 630 630 631 631 oobbuf_len = min_t(size_t, req.ooblen, mtd->erasesize); 632 632 if (oobbuf_len > 0) { 633 - oobbuf = kmalloc(oobbuf_len, GFP_KERNEL); 633 + oobbuf = kvmalloc(oobbuf_len, GFP_KERNEL); 634 634 if (!oobbuf) { 635 - kfree(datbuf); 635 + kvfree(datbuf); 636 636 return -ENOMEM; 637 637 } 638 638 } ··· 682 682 usr_oob += ops.oobretlen; 683 683 } 684 684 685 - kfree(datbuf); 686 - kfree(oobbuf); 685 + kvfree(datbuf); 686 + kvfree(oobbuf); 687 687 688 688 return ret; 689 689 }