Hi Laurent,
On Thu, Dec 13, 2018 at 02:57:46PM +0200, Laurent Pinchart wrote:
> Hi Sakari,
>
> Thank you for the patch.
>
> On Thursday, 13 December 2018 12:40:05 EET Sakari Ailus wrote:
> > buf->size is an unsigned long; casting that to int will lead to an
> > overflow if buf->size exceeds INT_MAX.
> >
> > Fix this by changing the type to unsigned long instead. This is possible
> > as the buf->size is always aligned to PAGE_SIZE, and therefore the size
> > will never have values lesser than 0.
>
> This feels a bit fragile to me. We at least need a big comment in the code to
> explain this. Another option would be a size -= min(..., size) just to make
> sure.
I was thinking of something like:
if (WARN_ON(size & ~PAGE_MASK))
return -ENOMEM;
But I opted to writing the third patch as this is not the only place where
the page alignment could be relevant.
What do you think?
>
> > Note on backporting to stable: the file used to be under
> > drivers/media/v4l2-core, it was moved to the current location after 4.14.
> >
> > Signed-off-by: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>
> > Cc: stable@xxxxxxxxxxxxxxx
> > ---
> > drivers/media/common/videobuf2/videobuf2-dma-sg.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
> > b/drivers/media/common/videobuf2/videobuf2-dma-sg.c index
> > 015e737095cdd..e9bfea986cc47 100644
> > --- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
> > +++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
> > @@ -59,7 +59,7 @@ static int vb2_dma_sg_alloc_compacted(struct
> > vb2_dma_sg_buf *buf, gfp_t gfp_flags)
> > {
> > unsigned int last_page = 0;
> > - int size = buf->size;
> > + unsigned long size = buf->size;
> >
> > while (size > 0) {
> > struct page *pages;
>
--
Sakari Ailus
sakari.ailus@xxxxxxxxxxxxxxx
