summaryrefslogtreecommitdiff
path: root/drivers/media/common
diff options
context:
space:
mode:
authorSakari Ailus <sakari.ailus@linux.intel.com>2018-12-12 07:44:14 -0500
committerMauro Carvalho Chehab <mchehab+samsung@kernel.org>2019-05-23 10:18:19 -0400
commit14f28f5cea9e3998442de87846d1907a531b6748 (patch)
tree4bca9373f00bf4ce1db88f848de7e3ef23597808 /drivers/media/common
parentdefcdc5d89ced780fb45196d539d6570ec5b1ba5 (diff)
media: videobuf2-dma-sg: Prevent size from overflowing
buf->size is an unsigned long; casting that to int will lead to an overflow if buf->size exceeds INT_MAX. Fix this by changing the type to unsigned long instead. This is possible as the buf->size is always aligned to PAGE_SIZE, and therefore the size will never have values lesser than 0. Note on backporting to stable: the file used to be under drivers/media/v4l2-core, it was moved to the current location after 4.14. Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Cc: stable@vger.kernel.org Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Diffstat (limited to 'drivers/media/common')
-rw-r--r--drivers/media/common/videobuf2/videobuf2-dma-sg.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
index 4a4c49d6085c..0f06f08346ba 100644
--- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
+++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
@@ -59,7 +59,7 @@ static int vb2_dma_sg_alloc_compacted(struct vb2_dma_sg_buf *buf,
gfp_t gfp_flags)
{
unsigned int last_page = 0;
- int size = buf->size;
+ unsigned long size = buf->size;
while (size > 0) {
struct page *pages;