[PATCH] drm/exynos: g2d: fix overflow of cmdlist size

[Tobias Jakobi]

Joonyoung Shim wrote:
> The size of cmdlist is integer type, so it can be overflowed by cmd and
> cmd_buf that has too big size. This patch will fix overflow issue as
> checking maximum size of cmd and cmd_buf.
I don't understand/see the issue here. Could you point out for which
input of the set_cmdlist ioctl you see this particular overflow?

In particular it is not clear to me which size field you're talking
about. struct g2d_cmdlist does not have any field named 'size'.

With best wishes,
Tobias


> Signed-off-by: Joonyoung Shim <jy0922.shim at samsung.com>
> ---
>  drivers/gpu/drm/exynos/exynos_drm_g2d.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
> index fbd13fa..b31244f 100644
> --- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
> +++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
> @@ -1250,7 +1250,14 @@ int exynos_g2d_set_cmdlist_ioctl(struct drm_device *drm_dev, void *data,
>  		cmdlist->data[cmdlist->last++] = G2D_INTEN_ACF;
>  	}
>  
> -	/* Check size of cmdlist: last 2 is about G2D_BITBLT_START */
> +	/* Check size of cmd and cmdlist: last 2 is about G2D_BITBLT_START */
> +	size = (G2D_CMDLIST_DATA_NUM - cmdlist->last - 2) / 2;
> +	if (req->cmd_nr > size || req->cmd_buf_nr > size) {
> +		dev_err(dev, "size of cmd or cmd_buf is too big\n");
> +		ret = -EINVAL;
> +		goto err_free_event;
> +	}
> +
>  	size = cmdlist->last + req->cmd_nr * 2 + req->cmd_buf_nr * 2 + 2;
>  	if (size > G2D_CMDLIST_DATA_NUM) {
>  		dev_err(dev, "cmdlist size is too big\n");
>