The size of cmdlist is integer type, so it can be overflowed by cmd and
cmd_buf that has too big size. This patch will fix overflow issue as
checking maximum size of cmd and cmd_buf.
Signed-off-by: Joonyoung Shim <jy0922.shim@xxxxxxxxxxx>
---
drivers/gpu/drm/exynos/exynos_drm_g2d.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index fbd13fa..b31244f 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -1250,7 +1250,14 @@ int exynos_g2d_set_cmdlist_ioctl(struct drm_device *drm_dev, void *data,
cmdlist->data[cmdlist->last++] = G2D_INTEN_ACF;
}
- /* Check size of cmdlist: last 2 is about G2D_BITBLT_START */
+ /* Check size of cmd and cmdlist: last 2 is about G2D_BITBLT_START */
+ size = (G2D_CMDLIST_DATA_NUM - cmdlist->last - 2) / 2;
+ if (req->cmd_nr > size || req->cmd_buf_nr > size) {
+ dev_err(dev, "size of cmd or cmd_buf is too big\n");
+ ret = -EINVAL;
+ goto err_free_event;
+ }
+
size = cmdlist->last + req->cmd_nr * 2 + req->cmd_buf_nr * 2 + 2;
if (size > G2D_CMDLIST_DATA_NUM) {
dev_err(dev, "cmdlist size is too big\n");
--
1.9.1
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/dri-devel
