Commit 8fddc4b6 authored by Gustavo A. R. Silva's avatar Gustavo A. R. Silva Committed by Kees Cook
Browse files

drm/gud: Use size_add() in call to struct_size() 



If, for any reason, the open-coded arithmetic causes a wraparound, the
protection that `struct_size()` adds against potential integer overflows
is defeated. Fix this by hardening call to `struct_size()` with `size_add()`.

Fixes: 40e1a70b ("drm: Add GUD USB Display driver")
Signed-off-by: default avatar"Gustavo A. R. Silva" <gustavoars@kernel.org>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/ZQSlyHKPdw/zsy4c@work


Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 6b343a46

drivers/gpu/drm/gud/gud_pipe.c

+1 −1
Original line number Diff line number Diff line
@@ -503,7 +503,7 @@ int gud_pipe_check(struct drm_simple_display_pipe *pipe, 
		return -ENOENT;



	len = struct_size(req, properties,

			  GUD_PROPERTIES_MAX_NUM + GUD_CONNECTOR_PROPERTIES_MAX_NUM);

			  size_add(GUD_PROPERTIES_MAX_NUM, GUD_CONNECTOR_PROPERTIES_MAX_NUM));

	req = kzalloc(len, GFP_KERNEL);

	if (!req)

		return -ENOMEM;