github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 22:14:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/msm: Fixup invalid overflow check

Browse Source 
On overflow struct_size() would return SIZE_MAX.  But kzalloc() (and
friends) check this already, so we can just remove the check.

On the other hand, we should be using the overflow helpers to calculate
the cmd array size.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/743111/
Message-ID: <20260729155609.20190-18-robin.clark@oss.qualcomm.com>
This commit is contained in:
Rob Clark 2026-07-29 08:55:54 -07:00
parent 1b8029394f
commit 7aeada642e
1 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/gpu/drm/msm/msm_gem_submit.c
View File

@ -36,14 +36,11 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev,
{
static atomic_t ident = ATOMIC_INIT(0);
struct msm_gem_submit *submit;
uint64_t sz;
size_t sz;
int ret;
sz = struct_size(submit, bos, nr_bos) +
((u64)nr_cmds * sizeof(submit->cmd[0]));
if (sz > SIZE_MAX)
return ERR_PTR(-ENOMEM);
sz = size_add(struct_size(submit, bos, nr_bos),
array_size(sizeof(submit->cmd[0]), nr_cmds));
submit = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN);
if (!submit)