mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-06 08:46:46 +00:00
Code Issues Releases Wiki Activity

gpu: host1x: fix an integer overflow check

Browse source 
Tegra is a 32 bit arch.  On 32 bit systems then size_t is 32 bits so
"total" will never be higher than UINT_MAX because of integer overflows.
We need cast to u64 first before doing the math.

Also the addition earlier:

        unsigned int num_unpins = num_cmdbufs + num_relocs;

That can overflow as well, but I think it's still safe because we check
both "num_cmdbufs" and "num_relocs" again in this test.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
This commit is contained in:
Dan Carpenter 2013-08-23 13:18:25 +03:00 committed by Thierry Reding
parent ccaddfe1a2
commit f5fda676e9
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
drivers/gpu/host1x/job.c
View file

@ -42,12 +42,12 @@ struct host1x_job *host1x_job_alloc(struct host1x_channel *ch,
/* Check that we're not going to overflow */
total = sizeof(struct host1x_job) +
num_relocs * sizeof(struct host1x_reloc) +
num_unpins * sizeof(struct host1x_job_unpin_data) +
num_waitchks * sizeof(struct host1x_waitchk) +
num_cmdbufs * sizeof(struct host1x_job_gather) +
num_unpins * sizeof(dma_addr_t) +
num_unpins * sizeof(u32 *);
(u64)num_relocs * sizeof(struct host1x_reloc) +
(u64)num_unpins * sizeof(struct host1x_job_unpin_data) +
(u64)num_waitchks * sizeof(struct host1x_waitchk) +
(u64)num_cmdbufs * sizeof(struct host1x_job_gather) +
(u64)num_unpins * sizeof(dma_addr_t) +
(u64)num_unpins * sizeof(u32 *);
if (total > ULONG_MAX)
return NULL;