From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3833333C188 for ; Fri, 17 Jul 2026 20:49:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784321361; cv=none; b=gAjqlTT6qZft6/SmZCpIyBKDqUK6XsZ+aPIOEQi2YtEpn3KD9p1a7I1Yl4hpDEP1C86/rPYtRWtJ8P3UEkNWPNFne159+uaRc5TxHZuS9XXUYSU1Bh15et/w4ze0kzUsiSDWMaGVjPPGBWDfFyXeYvIwtUUxmf6SpwtnxYsiQu0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784321361; c=relaxed/simple; bh=+8OgFO6VNJ8TsixnL3Bkmbua4zl1BlZxa3GBrY+qUZE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qpCuwc8ZEPDnH3hCrQTQ+0Hv9F2py2q20+otoEvHQ0/XWvpZQfVSM5M8UP11hBvTDl/LP3YgFuAiiw8V4PMbFsxuYncYZVPVxKxDwZB0CWHguiJM7TUOzPssUKDzT3HY2zsDcSzOAjCEJQxAOYYWFrkYQePZV/pDCWe90bV9NRo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=CkuhYW2M; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=IRVBzcHz; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="CkuhYW2M"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="IRVBzcHz" Received: from pps.filterd (m0279870.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66HJts8a2824506 for ; Fri, 17 Jul 2026 20:49:16 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=rc/ljxoshAi Nv4QJKXYpPgimbLWzx8XhYbA7LeAuwfE=; b=CkuhYW2MFx6PieJDfPOg1vAxRMi lQuODqYGR6MgKww/4cqAPa2xFIYsjXOu839fbOctmFjK2ZxudHzue/81/jeT+wTn Ok9nU/YlgDQtFksVD+75JqrGn0bau1dUV8bMZv+IdsfkmQ5Us405JfWpWSsIoPjm ttYRpFT4hkXOw1ppDCawJjuIJj2KZP/0uOHdjhieY6FUwBQRv00MHu03ma5fEPhl KvR3ouJDXaNEXpIqemY1Gy5JRofm0vNdNIyBDjU4Nq62CGtVwC+TzVwf7Sj50pQ9 nlEAP+maVneTbZtghXN0tpiCcrHnfC0VMn8e7AXxW4FGzM+uq1FRROtT3ng== Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fff8139qj-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Fri, 17 Jul 2026 20:49:15 +0000 (GMT) Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2cccfa32670so109619165ad.2 for ; Fri, 17 Jul 2026 13:49:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784321355; x=1784926155; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=rc/ljxoshAiNv4QJKXYpPgimbLWzx8XhYbA7LeAuwfE=; b=IRVBzcHz71x9koy3S32eCMdQrtN5HuU+rck41SEkLA5hxHb8wOnJR74gfyrqsb056O l6mkjcimnR/ZQZ+wPvRuEo8oI7H1XE2KAu2zzNy+NSnTlruyhuV6z80Maunhq3q8bToN d++jUyO++5PxFeS14nSSTxpXp6V1OAH//+E0DASfSdCGSpjuuXgS7B8n0uAierUDGhz5 JPgQB5rWd7p55uiu9OJmaGDwHgmGS4s8nmQpgCZW9yEGaSYejJovgWQhjkoCaIDusDPY 1gSRLK0OkbsR/Ui/JVr/ifTAanW01GhkiC9ZpL4bgFcjGLwBvf/tHBOnX0xOGqO+V2V9 dXVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784321355; x=1784926155; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=rc/ljxoshAiNv4QJKXYpPgimbLWzx8XhYbA7LeAuwfE=; b=NwZH7Tp4KLnfYkPYM7T8WnPDqk9rOkE1MGDEu2s4+vweBz5S9eRbqb+iRFZfFHFQUx H5e0/x3bkts1OzFtsn+zLAT/dsJI3UgJqpPdDXfJUrGdBJ5X+6qBYejsbuvqhKOhMTJF 8RDeJg+tdXgmQnmZeb3lNG4y96ti1m3xCC7TkpXDoxrRGFb1OkHYic54LltDGL7NccY3 jZbHbS/eypHEzrWAT8xgUaShkGHfK1i3sUr0PjZ13Q9Oak/4mh90E0isGnPJuKyM8zy1 DClpKzPqCtF2JNy8jAoR7TETC91/T1nyOG4y/0FlilCCUfZRFnEOijERRMrNuegZFpuk eT5A== X-Forwarded-Encrypted: i=1; AHgh+RrgkWgbPlETBa3bPG5+DQAbl7Nycf3h1o2AKpOyCBtsG9n0dSszpJ8O+jWjacSCB2p5A1U4UF76NOngPhw=@vger.kernel.org X-Gm-Message-State: AOJu0YzLQ64ScOJ3R6YyHKb8UmvM1S/Q6hqZuB5jt+I+5dNnH89lp1h4 tUX/jgDPBiIV+3quC69tMcXiUXXnOA3juwvisiJD+d9rWCiNWu+9OCOcg508isPP5UnDWWYN0Ai Ns2mcX6ttWRSbeYXZagA2ckW0TvuAEVt/qusRQiIzAvDBeWVE/sOI9XwqVBf9JQOdTZU= X-Gm-Gg: AfdE7ckTh1uOmcVlSpOdGoiNjyoxbOQPDBIC3w2dlgoojWn+03nuPNzl7zh2Q4Kn4/Q j0E3UOOaLjiIeHLi+1LJiCmyG68olUCjmCXyaAIOuh0udes1SN9R22WFdNJb4xUW8hJXtzR4bOj PvTA8KeUqKpYQ2mH5bxEBlHhfcCr/dUfuvv6vfhZBt3pmr0BhaLWz57/a2S67tZbuxuwgoJJod+ TZis3QkQyBzl1XCvRDI9mpireTnSin7RhadIFKuQ5fvWT3slrJZTuAI8SYklrskYT9RZie1uSNQ V/duCogwVA1yrpidHnd6CuTDS/NWWYaIxP9JHScLLaebVESpo/MkepzOGhyDSCifR3HBxVXexpn q9aJvgFp4Me0aPfGp/QYQaTnRk6gU1ICPB9SWlLvnDBKeswk= X-Received: by 2002:a17:903:1b6f:b0:2c6:a172:55a6 with SMTP id d9443c01a7336-2cf3481df5bmr48572675ad.9.1784321354899; Fri, 17 Jul 2026 13:49:14 -0700 (PDT) X-Received: by 2002:a17:903:1b6f:b0:2c6:a172:55a6 with SMTP id d9443c01a7336-2cf3481df5bmr48572335ad.9.1784321354470; Fri, 17 Jul 2026 13:49:14 -0700 (PDT) Received: from localhost (c-73-37-105-206.hsd1.or.comcast.net. [73.37.105.206]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf347165b1sm16750405ad.60.2026.07.17.13.49.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 13:49:13 -0700 (PDT) From: Rob Clark To: dri-devel@lists.freedesktop.org Cc: linux-arm-msm@vger.kernel.org, freedreno@lists.freedesktop.org, Rob Clark , Sashiko , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Sean Paul , Marijn Suijten , David Airlie , Simona Vetter , linux-kernel@vger.kernel.org (open list) Subject: [PATCH v6 16/16] drm/msm: Fixup invalid overflow check Date: Fri, 17 Jul 2026 13:48:32 -0700 Message-ID: <20260717204841.26120-17-robin.clark@oss.qualcomm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260717204841.26120-1-robin.clark@oss.qualcomm.com> References: <20260717204841.26120-1-robin.clark@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Authority-Analysis: v=2.4 cv=RbqgzVtv c=1 sm=1 tr=0 ts=6a5a954b cx=c_pps a=JL+w9abYAAE89/QcEU+0QA==:117 a=19Wyn7e3V/0aNffMjNCMQw==:17 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=gowsoOTTUOVcmtlkKump:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=uVkA5J_fsNn9jy38BCIA:9 a=324X-CrmTo6CU4MGRt3R:22 X-Proofpoint-GUID: cjrm5moJ6uGoSoluE5wYLV27RejkmG0L X-Proofpoint-ORIG-GUID: cjrm5moJ6uGoSoluE5wYLV27RejkmG0L X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE3MDIxNCBTYWx0ZWRfXxvlAvoRAKVob H493CihGpvXwYLVuMP2vYPen47Fr+vEbgeQDYk23goTeeWvZH2tKbq+27GDhNtbzsm1QG5SCtQ7 qF2P6bXPHxXXhcAaaHOSRLJOOjn14EYMF0Szc1gL45I3oKgl1qUcY/xdAElTUNSRfIAlffAQ25j kGCk0NwLsWx1K38YI81FFNdr+RKWDY5zfo1xr7+/bmf6IVwJJGJbiEFGmKMtTnU4STg2KYacOU7 uMtg9f46+7Zm+IUmAaiMFIlER3e/ZiBIiFo7tFMzsg6er28Cx7paXTQfT8HZowycnzbycXsYu50 BVv/pYDTg6Y4InCbIl7DGQATKxzAGmQnVQ1UJEbItWua0a3dMluIv+4/RS/9DfQMOJCR+TYbMay DKuYMgK9K2jc8mRrgZXB4H9hcRgVfoDJE6Dg/CfX8uk6k5YIIngI4GN3Q5SIW7xigMb8OJ/GxfH /WMe7qAhtAuROt35Igw== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE3MDIxNCBTYWx0ZWRfX0oN19597Mbo9 1qf98kNXdgEABMGaam5j1SNkNd4/YJFkR1zLyFsgyOp6zfpun25fS6FbZDfd+PP8asUo8SohNwg aSzuWs2rXC/hvryNBZKsSkqGucknNhE= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-17_06,2026-07-17_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 clxscore=1015 suspectscore=0 priorityscore=1501 lowpriorityscore=0 impostorscore=0 bulkscore=0 phishscore=0 adultscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607170214 On overflow struct_size() would return SIZE_MAX. But kzalloc() (and friends) check this already, so we can just remove the check. On the other hand, we should be using the overflow helpers to calculate the cmd array size. Reported-by: Sashiko Signed-off-by: Rob Clark --- drivers/gpu/drm/msm/msm_gem_submit.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c index 6b0bee6c39bc..5862db05297a 100644 --- a/drivers/gpu/drm/msm/msm_gem_submit.c +++ b/drivers/gpu/drm/msm/msm_gem_submit.c @@ -36,14 +36,11 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev, { static atomic_t ident = ATOMIC_INIT(0); struct msm_gem_submit *submit; - uint64_t sz; + size_t sz; int ret; - sz = struct_size(submit, bos, nr_bos) + - ((u64)nr_cmds * sizeof(submit->cmd[0])); - - if (sz > SIZE_MAX) - return ERR_PTR(-ENOMEM); + sz = size_add(struct_size(submit, bos, nr_bos), + array_size(sizeof(submit->cmd[0]), nr_cmds)); submit = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN); if (!submit) -- 2.55.0