Commit 3a47f4b4 authored by Dan Carpenter's avatar Dan Carpenter Committed by Rob Clark
Browse files

drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit() 



The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32
values that come from the user via the submit_lookup_cmds() function.
This addition could lead to an integer wrapping bug so use size_add()
to prevent that.

Fixes: 19872533 ("drm/msm: fix cmdstream size check")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/624696/


Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
parent 7a637e5e

drivers/gpu/drm/msm/msm_gem_submit.c

+1 −2
Original line number Diff line number Diff line
@@ -787,8 +787,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data, 
			goto out;



		if (!submit->cmd[i].size ||

			((submit->cmd[i].size + submit->cmd[i].offset) >

				obj->size / 4)) {

		    (size_add(submit->cmd[i].size, submit->cmd[i].offset) > obj->size / 4)) {

			SUBMIT_ERROR(submit, "invalid cmdstream size: %u\n", submit->cmd[i].size * 4);

			ret = -EINVAL;

			goto out;