Skip to contentSkip to conversation

gpu: host1x: fix an integer overflow check

PATCH In review Dan Carpenter 2 participants 2 messages Aug 23, 2013 – Aug 27, 2013

Subsystems (4)
DRM drivers Kernel janitors Tegra architecture support DRM drivers for NVIDIA Tegra
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/2 gpu: host1x: fix an integer overflow check

Tegra is a 32 bit arch. On 32 bit systems then size_t is 32 bits so "total" will never be higher than UINT_MAX because of integer overflows. We need cast to u64 first before doing the math.

Also the addition earlier:

        unsigned int num_unpins = num_cmdbufs + num_relocs;

That can overflow as well, but I think it's still safe because we check both "num_cmdbufs" and "num_relocs" again in this test.

Signed-off-by Dan Carpenter <[email protected]>

---
This is something I spotted in code review. I can't actually compile this code. I assume this overflow test has security implications.

drivers/gpu/host1x/job.c +6 -6
index cc80766..18a47f9 100644
@@ -42,12 +42,12 @@ struct host1x_job *host1x_job_alloc(struct host1x_channel *ch,
 
 	/* Check that we're not going to overflow */
 	total = sizeof(struct host1x_job) +
-		num_relocs * sizeof(struct host1x_reloc) +
-		num_unpins * sizeof(struct host1x_job_unpin_data) +
-		num_waitchks * sizeof(struct host1x_waitchk) +
-		num_cmdbufs * sizeof(struct host1x_job_gather) +
-		num_unpins * sizeof(dma_addr_t) +
-		num_unpins * sizeof(u32 *);
+		(u64)num_relocs * sizeof(struct host1x_reloc) +
+		(u64)num_unpins * sizeof(struct host1x_job_unpin_data) +
+		(u64)num_waitchks * sizeof(struct host1x_waitchk) +
+		(u64)num_cmdbufs * sizeof(struct host1x_job_gather) +
+		(u64)num_unpins * sizeof(dma_addr_t) +
+		(u64)num_unpins * sizeof(u32 *);
 	if (total > ULONG_MAX)
 		return NULL;
#1 lore raw
Quoted 8 lines · Dan Carpenter

Tegra is a 32 bit arch. On 32 bit systems then size_t is 32 bits so "total" will never be higher than UINT_MAX because of integer overflows. We need cast to u64 first before doing the math.

Also the addition earlier:

        unsigned int num_unpins = num_cmdbufs + num_relocs;
Quoted 7 lines

That can overflow as well, but I think it's still safe because we check both "num_cmdbufs" and "num_relocs" again in this test.

Signed-off-by Dan Carpenter <[email protected]>

---
This is something I spotted in code review. I can't actually compile this code. I assume this overflow test has security implications.

It did compile and looks good to me, so I've applied it.

Thanks,
Thierry