On 11/1/26 6:49 PM, Rob Clark wrote: > Use size_add() to guard against overflow. > > Reported-by: Konrad Dybcio <[email protected]> > Fixes: 3a3bef68a6c1 ("drm/msm: Fix missing VM_BIND offset/range validation") > Signed-off-by: Rob Clark <[email protected]> > --- > drivers/gpu/drm/msm/msm_gem_vma.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c > b/drivers/gpu/drm/msm/msm_gem_vma.c > index f687a629629d..16b3870d5e90 100644 > --- a/drivers/gpu/drm/msm/msm_gem_vma.c > +++ b/drivers/gpu/drm/msm/msm_gem_vma.c > @@ -1118,7 +1118,7 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, > struct drm_msm_vm_bind *args > op->obj = obj; > cnt++; > > - if ((op->range + op->obj_offset) > obj->size) { > + if (size_add(op->range, op->obj_offset) > obj->size) {
GPT and Sashiko are unhappy about what this does on 32b Konrad
