evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "drm/msm: Fix potential buffer overflow issue"

Browse source
This commit is contained in:
Linux Build Service Account 2017-05-31 17:57:58 -07:00 • committed by Gerrit - the friendly Code Review server
commit 1d64abeedd
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/gpu/drm/msm/msm_gem_submit.c
View file

@ -34,11 +34,15 @@ static inline void __user *to_user_ptr(u64 address)
} }
static struct msm_gem_submit *submit_create(struct drm_device *dev, static struct msm_gem_submit *submit_create(struct drm_device *dev,
struct msm_gem_address_space *aspace, int nr_bos, int nr_cmds) struct msm_gem_address_space *aspace,
uint32_t nr_bos, uint32_t nr_cmds)
{ {
struct msm_gem_submit *submit; struct msm_gem_submit *submit;
int sz = sizeof(*submit) + (nr_bos * sizeof(submit->bos[0])) + uint64_t sz = sizeof(*submit) + (nr_bos * sizeof(submit->bos[0])) +
(nr_cmds * sizeof(*submit->cmd)); (nr_cmds * sizeof(submit->cmd[0]));
if (sz > SIZE_MAX)
return NULL;
submit = kmalloc(sz, GFP_TEMPORARY | __GFP_NOWARN | __GFP_NORETRY); submit = kmalloc(sz, GFP_TEMPORARY | __GFP_NOWARN | __GFP_NORETRY);
if (submit) { if (submit) {