diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-02-28 12:23:21 +0300 |
|---|---|---|
| committer | Daniel Vetter <daniel.vetter@ffwll.ch> | 2020-02-29 00:16:12 +0100 |
| commit | abdd768e9ce18142c376188bfca4357ba489afb3 (patch) | |
| tree | 659e607f71de4bad2620dcfa774098787462e1d4 | |
| parent | df0e7f7e03c052cfe71cb3d729cb57386a34f104 (diff) | |
| download | linux-abdd768e9ce18142c376188bfca4357ba489afb3.tar.gz | |
drm: prevent a harmless integer overflow in drm_legacy_sg_alloc()
There is an integer overflow when we round up to PAGE_SIZE, but it's
harmless because we never re-use "request->size" for anything meaningful.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20200228092321.axulddmkxrujkmas@kili.mountain
| -rw-r--r-- | drivers/gpu/drm/drm_scatter.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/gpu/drm/drm_scatter.c b/drivers/gpu/drm/drm_scatter.c index d5c386154246..ca520028b2cb 100644 --- a/drivers/gpu/drm/drm_scatter.c +++ b/drivers/gpu/drm/drm_scatter.c @@ -99,6 +99,9 @@ int drm_legacy_sg_alloc(struct drm_device *dev, void *data, if (!drm_core_check_feature(dev, DRIVER_SG)) return -EOPNOTSUPP; + if (request->size > SIZE_MAX - PAGE_SIZE) + return -EINVAL; + if (dev->sg) return -EINVAL; |