Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b055211d authored by Thomas Hellstrom's avatar Thomas Hellstrom
Browse files

drm/vmwgfx: Fix possible integer overflow 



Cc: stable@vger.kernel.org
Reported-by: default avatarBrian Paul <brianp@vmware.com>
Signed-off-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: default avatarJakob Bornecrantz <jakob@vmware.com>
parent 4fbd9d2e

drivers/gpu/drm/vmwgfx/svga3d_surfacedefs.h

+7 −4
Original line number Diff line number Diff line
@@ -38,8 +38,11 @@ 


#define DIV_ROUND_UP(x, y)  (((x) + (y) - 1) / (y))

#define max_t(type, x, y)  ((x) > (y) ? (x) : (y))

#define min_t(type, x, y)  ((x) < (y) ? (x) : (y))

#define surf_size_struct SVGA3dSize

#define u32 uint32

#define u64 uint64_t

#define U32_MAX ((u32)~0U)



#endif /* __KERNEL__ */
@@ -704,8 +707,8 @@ static const struct svga3d_surface_desc svga3d_surface_descs[] = { 


static inline u32 clamped_umul32(u32 a, u32 b)

{

	uint64_t tmp = (uint64_t) a*b;

	return (tmp > (uint64_t) ((u32) -1)) ? (u32) -1 : tmp;

	u64 tmp = (u64) a*b;

	return (tmp > (u64) U32_MAX) ? U32_MAX : tmp;

}



static inline const struct svga3d_surface_desc *
@@ -834,7 +837,7 @@ svga3dsurface_get_serialized_size(SVGA3dSurfaceFormat format, 
				  bool cubemap)

{

	const struct svga3d_surface_desc *desc = svga3dsurface_get_desc(format);

	u32 total_size = 0;

	u64 total_size = 0;

	u32 mip;



	for (mip = 0; mip < num_mip_levels; mip++) {
@@ -847,7 +850,7 @@ svga3dsurface_get_serialized_size(SVGA3dSurfaceFormat format, 
	if (cubemap)

		total_size *= SVGA3D_MAX_SURFACE_FACES;



	return total_size;

	return (u32) min_t(u64, total_size, (u64) U32_MAX);

}