Patch "drm/msm: fix an integer overflow test" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

drm/msm: fix an integer overflow test

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
drm-msm-fix-an-integer-overflow-test.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Dan Carpenter <[email protected]>
Date: Fri, 30 Jun 2017 10:59:15 +0300
Subject: drm/msm: fix an integer overflow test

From: Dan Carpenter <[email protected]>

commit 65e93108891e571f177c202add9288eda9ac4100 upstream.

We recently added an integer overflow check but it needs an additional tweak to work properly on 32 bit systems.

The problem is that we're doing the right hand side of the assignment as type unsigned long so the max it will have an integer overflow instead of being larger than SIZE_MAX. That means the "sz > SIZE_MAX" condition is never true even on 32 bit systems. We need to first cast it to u64 and then do the math.

---
 drivers/gpu/drm/msm/msm_gem_submit.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -34,8 +34,8 @@ static struct msm_gem_submit *submit_cre
 		struct msm_gpu *gpu, uint32_t nr_bos, uint32_t nr_cmds)
 {
 	struct msm_gem_submit *submit;
-	uint64_t sz = sizeof(*submit) + (nr_bos * sizeof(submit->bos[0])) +
-		(nr_cmds * sizeof(submit->cmd[0]));
+	uint64_t sz = sizeof(*submit) + ((u64)nr_bos * sizeof(submit->bos[0])) +
+		((u64)nr_cmds * sizeof(submit->cmd[0]));
 
 	if (sz > SIZE_MAX)
 		return NULL;

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/drm-msm-fix-an-integer-overflow-test.patch