On Mon, Nov 2, 2026 at 5:59 AM Rob Clark <[email protected]> wrote: > > On Mon, Nov 2, 2026 at 1:40 AM Konrad Dybcio > <[email protected]> wrote: > > > > On 11/1/26 6:49 PM, Rob Clark wrote: > > > Use size_add() to guard against overflow. > > > > > > Reported-by: Konrad Dybcio <[email protected]> > > > Fixes: 3a3bef68a6c1 ("drm/msm: Fix missing VM_BIND offset/range > > > validation") > > > Signed-off-by: Rob Clark <[email protected]> > > > --- > > > drivers/gpu/drm/msm/msm_gem_vma.c | 2 +- > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c > > > b/drivers/gpu/drm/msm/msm_gem_vma.c > > > index f687a629629d..16b3870d5e90 100644 > > > --- a/drivers/gpu/drm/msm/msm_gem_vma.c > > > +++ b/drivers/gpu/drm/msm/msm_gem_vma.c > > > @@ -1118,7 +1118,7 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, > > > struct drm_msm_vm_bind *args > > > op->obj = obj; > > > cnt++; > > > > > > - if ((op->range + op->obj_offset) > obj->size) { > > > + if (size_add(op->range, op->obj_offset) > obj->size) { > > > > GPT and Sashiko are unhappy about what this does on 32b > > Considering that we can't have >4gb BOs on 32b, I think the concerns > are probably unwarranted. But yes, I do look at Sashiko's reports
Probably we should add checks that obj_offset/range are not more than SIZE_MAX? BR, -R
