Merge "drm/msm: Fix possible overflow issue in submit_cmd" (cf8803d7) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/gpu/drm/msm/msm_gem_submit.c

+8 −7

Original line number	Diff line number	Diff line
		@@ -385,7 +385,8 @@ int msm_ioctl_gem_submit(struct drm_device dev, void data,
		void __user *userptr =
		to_user_ptr(args->cmds + (i * sizeof(submit_cmd)));
		struct msm_gem_object *msm_obj;
		uint32_t iova;
		uint64_t iova;
		size_t size;

		ret = copy_from_user(&submit_cmd, userptr, sizeof(submit_cmd));
		if (ret) {
		@@ -417,12 +418,12 @@ int msm_ioctl_gem_submit(struct drm_device dev, void data,
		goto out;
		}

		if ((submit_cmd.size + submit_cmd.submit_offset) >
		msm_obj->base.size) {
		DRM_ERROR(
		"invalid cmdstream size:%u, offset:%u, base_size:%zu\n",
		submit_cmd.size, submit_cmd.submit_offset,
		msm_obj->base.size);
		size = submit_cmd.size + submit_cmd.submit_offset;

		if (!submit_cmd.size \|\| (size < submit_cmd.size) \|\|
		(size > msm_obj->base.size)) {
		DRM_ERROR("invalid cmdstream offset/size: %u/%u\n",
		submit_cmd.submit_offset, submit_cmd.size);
		ret = -EINVAL;
		goto out;
		}