Merge "drm/msm: Fix possible overflow issue in submit_cmd" (0bb8d348) · Commits · e / devices / android_kernel_sony_msm8998

drivers/gpu/drm/msm/msm_gem_submit.c

+7 −4

Original line number	Diff line number	Diff line
		@@ -434,6 +434,7 @@ int msm_ioctl_gem_submit(struct drm_device dev, void data,
		to_user_ptr(args->cmds + (i * sizeof(submit_cmd)));
		struct msm_gem_object *msm_obj;
		uint64_t iova;
		size_t size;

		ret = copy_from_user(&submit_cmd, userptr, sizeof(submit_cmd));
		if (ret) {
		@@ -466,10 +467,12 @@ int msm_ioctl_gem_submit(struct drm_device dev, void data,
		goto out;
		}

		if (!(submit_cmd.size) \|\|
		((submit_cmd.size + submit_cmd.submit_offset) >
		msm_obj->base.size)) {
		DRM_ERROR("invalid cmdstream size: %u\n", submit_cmd.size);
		size = submit_cmd.size + submit_cmd.submit_offset;

		if (!submit_cmd.size \|\| (size < submit_cmd.size) \|\|
		(size > msm_obj->base.size)) {
		DRM_ERROR("invalid cmdstream offset/size: %u/%u\n",
		submit_cmd.submit_offset, submit_cmd.size);
		ret = -EINVAL;
		goto out;
		}