From patchwork Mon Sep 26 09:23:15 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Li Qiong X-Patchwork-Id: 609707 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60941C07E9D for ; Mon, 26 Sep 2022 09:26:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234245AbiIZJ0V (ORCPT ); Mon, 26 Sep 2022 05:26:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47122 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234251AbiIZJZq (ORCPT ); Mon, 26 Sep 2022 05:25:46 -0400 Received: from mail.nfschina.com (mail.nfschina.com [124.16.136.209]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id B5E31E0CD; Mon, 26 Sep 2022 02:24:49 -0700 (PDT) Received: from localhost (unknown [127.0.0.1]) by mail.nfschina.com (Postfix) with ESMTP id F2DCF1E80D99; Mon, 26 Sep 2022 17:20:46 +0800 (CST) X-Virus-Scanned: amavisd-new at test.com Received: from mail.nfschina.com ([127.0.0.1]) by localhost (mail.nfschina.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RtFvrhUFBcKz; Mon, 26 Sep 2022 17:20:44 +0800 (CST) Received: from localhost.localdomain (unknown [180.167.10.98]) (Authenticated sender: liqiong@nfschina.com) by mail.nfschina.com (Postfix) with ESMTPA id AC4901E80D96; Mon, 26 Sep 2022 17:20:43 +0800 (CST) From: Li Qiong To: Rob Clark , Abhinav Kumar , Dmitry Baryshkov , Sean Paul , David Airlie , Daniel Vetter Cc: linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, freedreno@lists.freedesktop.org, linux-kernel@vger.kernel.org, Yu Zhe , Li Qiong Subject: [PATCH] drm/msm/gem: Use size_add() against integer overflow Date: Mon, 26 Sep 2022 17:23:15 +0800 Message-Id: <20220926092315.17193-1-liqiong@nfschina.com> X-Mailer: git-send-email 2.11.0 Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org "struct_size() + n" may cause a integer overflow, use size_add() to handle it. Signed-off-by: Li Qiong --- drivers/gpu/drm/msm/msm_gem_submit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c index c9e4aeb14f4a..3dec87e46e50 100644 --- a/drivers/gpu/drm/msm/msm_gem_submit.c +++ b/drivers/gpu/drm/msm/msm_gem_submit.c @@ -30,8 +30,8 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev, uint64_t sz; int ret; - sz = struct_size(submit, bos, nr_bos) + - ((u64)nr_cmds * sizeof(submit->cmd[0])); + sz = size_add(struct_size(submit, bos, nr_bos), + ((u64)nr_cmds * sizeof(submit->cmd[0]))); if (sz > SIZE_MAX) return ERR_PTR(-ENOMEM);