diff options
| author | Lizhi Hou <lizhi.hou@amd.com> | 2026-02-17 11:28:15 -0800 |
|---|---|---|
| committer | Lizhi Hou <lizhi.hou@amd.com> | 2026-02-23 09:24:21 -0800 |
| commit | 03808abb1d868aed7478a11a82e5bb4b3f1ca6d6 (patch) | |
| tree | 40445a2c540753181393db8aaec7fc7ead6aa596 /drivers/accel | |
| parent | 1110a949675ebd56b3f0286e664ea543f745801c (diff) | |
| download | linux-next-03808abb1d868aed7478a11a82e5bb4b3f1ca6d6.tar.gz linux-next-03808abb1d868aed7478a11a82e5bb4b3f1ca6d6.zip | |
accel/amdxdna: Prevent ubuf size overflow
The ubuf size calculation may overflow, resulting in an undersized
allocation and possible memory corruption.
Use check_add_overflow() helpers to validate the size calculation before
allocation.
Fixes: bd72d4acda10 ("accel/amdxdna: Support user space allocated buffer")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260217192815.1784689-1-lizhi.hou@amd.com
Diffstat (limited to 'drivers/accel')
| -rw-r--r-- | drivers/accel/amdxdna/amdxdna_ubuf.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/accel/amdxdna/amdxdna_ubuf.c b/drivers/accel/amdxdna/amdxdna_ubuf.c index b509f10b155c..fb71d6e3f44d 100644 --- a/drivers/accel/amdxdna/amdxdna_ubuf.c +++ b/drivers/accel/amdxdna/amdxdna_ubuf.c @@ -7,6 +7,7 @@ #include <drm/drm_device.h> #include <drm/drm_print.h> #include <linux/dma-buf.h> +#include <linux/overflow.h> #include <linux/pagemap.h> #include <linux/vmalloc.h> @@ -176,7 +177,10 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev, goto free_ent; } - exp_info.size += va_ent[i].len; + if (check_add_overflow(exp_info.size, va_ent[i].len, &exp_info.size)) { + ret = -EINVAL; + goto free_ent; + } } ubuf->nr_pages = exp_info.size >> PAGE_SHIFT; |