The warning appears because the size passed to kvzalloc is larger than INT_MAX. Add parameter size check before calling kvzalloc in __v4l2_ctrl_modify_dimensions. #syz test diff --git a/drivers/media/v4l2-core/v4l2-ctrls-api.c b/drivers/media/v4l2-core/v4l2-ctrls-api.c index e5a364efd5e6..0b008cc94901 100644 --- a/drivers/media/v4l2-core/v4l2-ctrls-api.c +++ b/drivers/media/v4l2-core/v4l2-ctrls-api.c @@ -986,6 +986,7 @@ int __v4l2_ctrl_modify_dimensions(struct v4l2_ctrl *ctrl, unsigned int elems = 1; unsigned int i; void *p_array; + unsigned int bytes; lockdep_assert_held(ctrl->handler->lock); @@ -996,7 +997,12 @@ int __v4l2_ctrl_modify_dimensions(struct v4l2_ctrl *ctrl, elems *= dims[i]; if (elems == 0) return -EINVAL; - p_array = kvzalloc(2 * elems * ctrl->elem_size, GFP_KERNEL); + + bytes = 2 * elems * ctrl->elem_size; + if (unlikely(bytes > INT_MAX)) + return -EINVAL; + + p_array = kvzalloc(bytes, GFP_KERNEL); if (!p_array) return -ENOMEM; kvfree(ctrl->p_array);
