diff options
| author | Dan Carpenter <dan.carpenter@linaro.org> | 2025-05-23 19:09:52 +0300 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2025-06-03 15:31:13 -0400 |
| commit | 335f1e797c32cbe6f313805125526b35d29280b0 (patch) | |
| tree | fa1a98a819294da6d203b2e6c28d4782e9608adc /drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | |
| parent | 98a46a408998102af5c45adce0871acd7967bb59 (diff) | |
drm/amdgpu: Fix integer overflow in amdgpu_gem_add_input_fence()
The "num_syncobj_handles" is a u32 value that comes from the user via the
ioctl. On 32bit systems the "sizeof(uint32_t) * num_syncobj_handles"
multiplication can have an integer overflow. Use size_mul() to fix that.
Fixes: 38c67ec9aa4b ("drm/amdgpu: Add input fence to sync bo map/unmap")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c index 2c68118fe9fd..0ecc88df7208 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c @@ -58,7 +58,7 @@ amdgpu_gem_add_input_fence(struct drm_file *filp, return 0; syncobj_handles = memdup_user(u64_to_user_ptr(syncobj_handles_array), - sizeof(uint32_t) * num_syncobj_handles); + size_mul(sizeof(uint32_t), num_syncobj_handles)); if (IS_ERR(syncobj_handles)) return PTR_ERR(syncobj_handles); |