Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 87bae91a authored by Sakari Ailus's avatar Sakari Ailus Committed by Greg Kroah-Hartman
Browse files

media: videobuf2-dma-sg: Prevent size from overflowing 



commit 14f28f5cea9e3998442de87846d1907a531b6748 upstream.

buf->size is an unsigned long; casting that to int will lead to an
overflow if buf->size exceeds INT_MAX.

Fix this by changing the type to unsigned long instead. This is possible
as the buf->size is always aligned to PAGE_SIZE, and therefore the size
will never have values lesser than 0.

Note on backporting to stable: the file used to be under
drivers/media/v4l2-core, it was moved to the current location after 4.14.

Signed-off-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent cb2e2b0a

drivers/media/common/videobuf2/videobuf2-dma-sg.c

+1 −1
Original line number Diff line number Diff line
@@ -59,7 +59,7 @@ static int vb2_dma_sg_alloc_compacted(struct vb2_dma_sg_buf *buf, 
		gfp_t gfp_flags)

{

	unsigned int last_page = 0;

	int size = buf->size;

	unsigned long size = buf->size;



	while (size > 0) {

		struct page *pages;