openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

drm: prevent a harmless integer overflow in drm_legacy_sg_alloc() 

There is an integer overflow when we round up to PAGE_SIZE, but it's
harmless because we never re-use "request->size" for anything meaningful.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20200228092321.axulddmkxrujkmas@kili.mountain
This commit is contained in:
Dan Carpenter 2020-02-28 12:23:21 +03:00 committed by Daniel Vetter
parent df0e7f7e03
commit abdd768e9c
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/gpu/drm/drm_scatter.c
View File

@ -99,6 +99,9 @@ int drm_legacy_sg_alloc(struct drm_device *dev, void *data,
if (!drm_core_check_feature(dev, DRIVER_SG))
return -EOPNOTSUPP;
if (request->size > SIZE_MAX - PAGE_SIZE)
return -EINVAL;
if (dev->sg)
return -EINVAL;