Use size_add() to guard against overflow.
Reported-by: Konrad Dybcio <[email protected]>
Fixes: 3a3bef68a6c1 ("drm/msm: Fix missing VM_BIND offset/range validation")
Reviewed-by: Dmitry Baryshkov <[email protected]>
Signed-off-by: Rob Clark <[email protected]>
---
drivers/gpu/drm/msm/msm_gem_vma.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c
b/drivers/gpu/drm/msm/msm_gem_vma.c
index f687a629629d..922285537dee 100644
--- a/drivers/gpu/drm/msm/msm_gem_vma.c
+++ b/drivers/gpu/drm/msm/msm_gem_vma.c
@@ -1012,10 +1012,10 @@ lookup_op(struct msm_vm_bind_job *job, const struct
drm_msm_vm_bind_op *op)
if (invalid_alignment(op->iova))
ret = UERR(EINVAL, dev, "invalid address: %016llx\n", op->iova);
- if (invalid_alignment(op->obj_offset))
+ if (invalid_alignment(op->obj_offset) || (op->obj_offset > SIZE_MAX))
ret = UERR(EINVAL, dev, "invalid bo_offset: %016llx\n",
op->obj_offset);
- if (invalid_alignment(op->range))
+ if (invalid_alignment(op->range) || (op->range > SIZE_MAX))
ret = UERR(EINVAL, dev, "invalid range: %016llx\n", op->range);
if (!drm_gpuvm_range_valid(job->vm, op->iova, op->range))
@@ -1118,7 +1118,7 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job,
struct drm_msm_vm_bind *args
op->obj = obj;
cnt++;
- if ((op->range + op->obj_offset) > obj->size) {
+ if (size_add(op->range, op->obj_offset) > obj->size) {
ret = UERR(EINVAL, dev, "invalid range: %016llx +
%016llx > %016zx\n",
op->range, op->obj_offset, obj->size);
goto out_unlock;
--
2.56.0
