drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32 values that come from the user via the submit_lookup_cmds() function. This addition could lead to an integer wrapping bug so use size_add() to prevent that. Fixes: 1987253 ("drm/msm: fix cmdstream size check") Cc: [email protected] Signed-off-by: Dan Carpenter <[email protected]> Patchwork: https://patchwork.freedesktop.org/patch/624696/ Signed-off-by: Rob Clark <[email protected]>
kdave · Jan 3, 2025 · 3a47f4b · 3a47f4b
1 parent 7a637e5
commit 3a47f4b
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -787,8 +787,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
 			goto out;
 
 		if (!submit->cmd[i].size ||
-			((submit->cmd[i].size + submit->cmd[i].offset) >
-				obj->size / 4)) {
+		    (size_add(submit->cmd[i].size, submit->cmd[i].offset) > obj->size / 4)) {
 			SUBMIT_ERROR(submit, "invalid cmdstream size: %u\n", submit->cmd[i].size * 4);
 			ret = -EINVAL;
 			goto out;