Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f63f3cf5 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: kgsl: Fix integer overflow in kgsl_ioctl_gpu_aux_command ioctl"

parents 628a0140 d6876813
Loading
Loading
Loading
Loading
+5 −2
Original line number Diff line number Diff line
@@ -1939,8 +1939,11 @@ long kgsl_ioctl_gpu_aux_command(struct kgsl_device_private *dev_priv,
		(KGSL_GPU_AUX_COMMAND_TIMELINE)))
		return -EINVAL;

	/* Make sure we don't overflow count */
	if (param->numcmds == UINT_MAX)
	/*
	 * Make sure we don't overflow count. Couple of drawobjs are reserved:
	 * One drawobj for timestamp sync and another for aux command sync.
	 */
	if (param->numcmds > (UINT_MAX - 2))
		return -EINVAL;

	context = kgsl_context_get_owner(dev_priv, param->context_id);