Commit 65e93108 authored by Dan Carpenter's avatar Dan Carpenter Committed by Rob Clark

drm/msm: fix an integer overflow test

We recently added an integer overflow check but it needs an additional
tweak to work properly on 32 bit systems.

The problem is that we're doing the right hand side of the assignment as
type unsigned long so the max it will have an integer overflow instead
of being larger than SIZE_MAX.  That means the "sz > SIZE_MAX" condition
is never true even on 32 bit systems.  We need to first cast it to u64
and then do the math.

Fixes: 4a630fad ("drm/msm: Fix potential buffer overflow issue")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarJordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: default avatarRob Clark <robdclark@gmail.com>
parent d490c9cd
...@@ -34,8 +34,8 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev, ...@@ -34,8 +34,8 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev,
struct msm_gpu *gpu, uint32_t nr_bos, uint32_t nr_cmds) struct msm_gpu *gpu, uint32_t nr_bos, uint32_t nr_cmds)
{ {
struct msm_gem_submit *submit; struct msm_gem_submit *submit;
uint64_t sz = sizeof(*submit) + (nr_bos * sizeof(submit->bos[0])) + uint64_t sz = sizeof(*submit) + ((u64)nr_bos * sizeof(submit->bos[0])) +
(nr_cmds * sizeof(submit->cmd[0])); ((u64)nr_cmds * sizeof(submit->cmd[0]));
if (sz > SIZE_MAX) if (sz > SIZE_MAX)
return NULL; return NULL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment