diff options
| author | Dan Carpenter <[email protected]> | 2024-11-15 14:50:08 +0000 |
|---|---|---|
| committer | Rob Clark <[email protected]> | 2025-01-03 15:20:27 +0000 |
| commit | 3a47f4b439beb98e955d501c609dfd12b7836d61 (patch) | |
| tree | d6dc9def5a1814047544ee6faf6d427eaf7873c6 /drivers/gpu/drm/msm/msm_submitqueue.c | |
| parent | drm/msm: Expose uche trap base via uapi (diff) | |
| download | kernel-3a47f4b439beb98e955d501c609dfd12b7836d61.tar.gz kernel-3a47f4b439beb98e955d501c609dfd12b7836d61.zip | |
drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()
The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32
values that come from the user via the submit_lookup_cmds() function.
This addition could lead to an integer wrapping bug so use size_add()
to prevent that.
Fixes: 198725337ef1 ("drm/msm: fix cmdstream size check")
Cc: [email protected]
Signed-off-by: Dan Carpenter <[email protected]>
Patchwork: https://patchwork.freedesktop.org/patch/624696/
Signed-off-by: Rob Clark <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/msm/msm_submitqueue.c')
0 files changed, 0 insertions, 0 deletions