TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

Browse Source 
The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32
values that come from the user via the submit_lookup_cmds() function.
This addition could lead to an integer wrapping bug so use size_add()
to prevent that.

Fixes: 198725337e ("drm/msm: fix cmdstream size check")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/624696/
Signed-off-by: Rob Clark <robdclark@chromium.org>
This commit is contained in:
Dan Carpenter
2024-11-15 17:50:08 +03:00
committed by Rob Clark
parent 7a637e5e27
commit 3a47f4b439
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/gpu/drm/msm/msm_gem_submit.c
+1 -2
View File
@@ -787,8 +787,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
goto out; goto out;
if (!submit->cmd[i].size || if (!submit->cmd[i].size ||
((submit->cmd[i].size + submit->cmd[i].offset) > (size_add(submit->cmd[i].size, submit->cmd[i].offset) > obj->size / 4)) {
obj->size / 4)) {
SUBMIT_ERROR(submit, "invalid cmdstream size: %u\n", submit->cmd[i].size * 4); SUBMIT_ERROR(submit, "invalid cmdstream size: %u\n", submit->cmd[i].size * 4);
ret = -EINVAL; ret = -EINVAL;
goto out; goto out;