On 11/2/26 4:18 PM, Rob Clark wrote: > On Mon, Nov 2, 2026 at 5:59 AM Rob Clark <[email protected]> wrote: >> >> On Mon, Nov 2, 2026 at 1:40 AM Konrad Dybcio >> <[email protected]> wrote: >>> >>> On 11/1/26 6:49 PM, Rob Clark wrote: >>>> Use size_add() to guard against overflow. >>>> >>>> Reported-by: Konrad Dybcio <[email protected]> >>>> Fixes: 3a3bef68a6c1 ("drm/msm: Fix missing VM_BIND offset/range >>>> validation") >>>> Signed-off-by: Rob Clark <[email protected]> >>>> --- >>>> drivers/gpu/drm/msm/msm_gem_vma.c | 2 +- >>>> 1 file changed, 1 insertion(+), 1 deletion(-) >>>> >>>> diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c >>>> b/drivers/gpu/drm/msm/msm_gem_vma.c >>>> index f687a629629d..16b3870d5e90 100644 >>>> --- a/drivers/gpu/drm/msm/msm_gem_vma.c >>>> +++ b/drivers/gpu/drm/msm/msm_gem_vma.c >>>> @@ -1118,7 +1118,7 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, >>>> struct drm_msm_vm_bind *args >>>> op->obj = obj; >>>> cnt++; >>>> >>>> - if ((op->range + op->obj_offset) > obj->size) { >>>> + if (size_add(op->range, op->obj_offset) > obj->size) { >>> >>> GPT and Sashiko are unhappy about what this does on 32b >> >> Considering that we can't have >4gb BOs on 32b, I think the concerns >> are probably unwarranted. But yes, I do look at Sashiko's reports > > Probably we should add checks that obj_offset/range are not more than > SIZE_MAX?
Wouldn't hurt Konrad
