From af84577f4be7d7ffd03c508a94ab440a84e7e5db Mon Sep 17 00:00:00 2001 From: Puranam V G Tejaswi Date: Wed, 7 Apr 2021 23:24:58 +0530 Subject: [PATCH] msm: kgsl: Fix overflow issue by checking user supplied count User supplied count can cause signed integer overflow when passed to dma_fence_array_create. So make sure that count is less than INT_MAX. Change-Id: Ie6f57e06a8f23e9fdc10f8a368921b9ad3516eba Signed-off-by: Puranam V G Tejaswi --- drivers/gpu/msm/kgsl_timeline.c | 4 ++-- drivers/gpu/msm/kgsl_timeline.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/msm/kgsl_timeline.c b/drivers/gpu/msm/kgsl_timeline.c index 0c9be32d9b90..e9ec5ce3b007 100644 --- a/drivers/gpu/msm/kgsl_timeline.c +++ b/drivers/gpu/msm/kgsl_timeline.c @@ -23,14 +23,14 @@ struct kgsl_timeline_fence { }; struct dma_fence *kgsl_timelines_to_fence_array(struct kgsl_device *device, - u64 timelines, u64 count, u64 usize, bool any) + u64 timelines, u32 count, u64 usize, bool any) { void __user *uptr = u64_to_user_ptr(timelines); struct dma_fence_array *array; struct dma_fence **fences; int i, ret = 0; - if (!count) + if (!count || count > INT_MAX) return ERR_PTR(-EINVAL); fences = kcalloc(count, sizeof(*fences), diff --git a/drivers/gpu/msm/kgsl_timeline.h b/drivers/gpu/msm/kgsl_timeline.h index 4392833f2a04..064dad37ea6c 100644 --- a/drivers/gpu/msm/kgsl_timeline.h +++ b/drivers/gpu/msm/kgsl_timeline.h @@ -108,6 +108,6 @@ static inline void kgsl_timeline_put(struct kgsl_timeline *timeline) * encapsulated timeline fences to expire. */ struct dma_fence *kgsl_timelines_to_fence_array(struct kgsl_device *device, - u64 timelines, u64 count, u64 usize, bool any); + u64 timelines, u32 count, u64 usize, bool any); #endif