Merge "drm/msm: Fix potential buffer overflow issue" (e6dd47e2) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/gpu/drm/msm/msm_gem_submit.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -34,12 +34,15 @@ static inline void __user *to_user_ptr(u64 address)
		}

		static struct msm_gem_submit submit_create(struct drm_device dev,
		struct msm_gpu *gpu, int nr_cmds, int nr_bos)
		struct msm_gpu *gpu, uint32_t nr_cmds, uint32_t nr_bos)
		{
		struct msm_gem_submit *submit;
		int sz = sizeof(submit) + (nr_bos sizeof(submit->bos[0])) +
		uint64_t sz = sizeof(submit) + (nr_bos sizeof(submit->bos[0])) +
		(nr_cmds * sizeof(submit->cmd[0]));

		if (sz > SIZE_MAX)
		return NULL;

		submit = kmalloc(sz, GFP_TEMPORARY \| __GFP_NOWARN \| __GFP_NORETRY);
		if (submit) {
		submit->dev = dev;