From: Russell King <rmk+kernel@xxxxxxxxxxxxxxxx>
Additions can overflow, when they do, they can lead to incorrect
results. When we verify that the buffer offset and size fit within
the buffer object, we must do this safely.
Signed-off-by: Russell King <rmk+kernel@xxxxxxxxxxxxxxxx>
---
drivers/staging/etnaviv/etnaviv_gem_submit.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/etnaviv/etnaviv_gem_submit.c b/drivers/staging/etnaviv/etnaviv_gem_submit.c
index f8b733a0e313..39ae61ab43fd 100644
--- a/drivers/staging/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/staging/etnaviv/etnaviv_gem_submit.c
@@ -380,7 +380,8 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data,
*/
max_size = etnaviv_obj->base.size - 8;
- if ((submit_cmd.size + submit_cmd.submit_offset) > max_size) {
+ if (submit_cmd.size > max_size ||
+ submit_cmd.submit_offset > max_size - submit_cmd.size) {
DRM_ERROR("invalid cmdstream size: %u\n", submit_cmd.size);
ret = -EINVAL;
goto out;
--
2.1.4
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/dri-devel
