From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 974194D98EF for ; Wed, 29 Jul 2026 15:57:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785340641; cv=none; b=sxre0LjKLhV6H+zvK9CSB+7rHrF73YA+ROSjTNvCwUVM/fhHD+jkqZVSB10neoUDrHdW3crs1jQ/3/INpSUbJFaAhdSL+EgeNWdvUFUEiHdkQdIFFyB63v4XE5g/rgxO+VNSzYOgV+CuaYuzI711gUY1/n5c8WTcLLP+CGedjBM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785340641; c=relaxed/simple; bh=+8OgFO6VNJ8TsixnL3Bkmbua4zl1BlZxa3GBrY+qUZE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=S3lLTO4RjRQVU4/u0F7d4W5LN+8NB1kWVp3JXkYSVl9RInr7Z5dW/+yAxIWaq7WeE+ivOE2RSLpzXCX6HjWPxW8S805uLsNLqaiHVSqBWDnAk/VFJ+YAwXN1ZFAfFvMl/Gm81TQ1cNEgmiojT5IPlqfd2OLnh2KfbWnhGXhr+HA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=NLW+n1ZF; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=N5mI11q+; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="NLW+n1ZF"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="N5mI11q+" Received: from pps.filterd (m0279865.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66TF3I7h2593240 for ; Wed, 29 Jul 2026 15:57:20 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=qcppdkim1; bh=rc/ljxoshAi Nv4QJKXYpPgimbLWzx8XhYbA7LeAuwfE=; b=NLW+n1ZFkIgpdJRzhttM74NX2Vp mV1yiw+VWqwLzB3KDZduqA0EQZooSt/+BsXgJV/1Auzf/MFZsG1RNBdmOybSY9ZU F5r2Q0/2NUjGeX2izKZiwKNQ5gzJK274JDmFKdZENGS5COmbqBk6N0/eeKxrudo0 II9vU2lO8PDPymkWI8Ps9lLeu9K8GejOCicLOiwOiRwzttMJGijhmOZclegy0AqH HqspeH0mA7lp6z1+ERoosuxvBJFLZDAWP7BnY9CRFrArvxcL1R1mLJ5NA8V6oP+W RLTq0YeGeGEPtNFkHUALOUsaIw297ugR1lv+ZmQikDRXB1HdgshZSdE6Xwg== Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fqke08h1y-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 29 Jul 2026 15:57:19 +0000 (GMT) Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-848544a8496so1224319b3a.0 for ; Wed, 29 Jul 2026 08:57:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1785340639; x=1785945439; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=rc/ljxoshAiNv4QJKXYpPgimbLWzx8XhYbA7LeAuwfE=; b=N5mI11q+PfllW2oYGIFDuZnYj/ZlmBeH6wTH4NrWdma7i4N/9z6XWxUsql1PHUV1/4 l4n+Hchxe45jwS/4qy5usqurBqgPdNJu9n3lWd7pXEBUTmeMA7qnc3Ufo9FmpXr5KmjX sMfNuXCAj1nt3PGtL3KfFyEws7qPWVEdywsnJ6V7OdJQgkoqJ0md+DkS3ndbHlnNqb7b I4KoBLjppXv0nueru5qpNiJNL8Gy7tLbTIt6hNIcYcCUbV70ccTojSQ2XNOyUpTO2TfE pvbPMxGmtTjbtF96eWLvkzgNTGI6Q/9DgeoUiwSwkVrvHbrVieppLHkvoqIn7ylOmAta LO5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785340639; x=1785945439; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=rc/ljxoshAiNv4QJKXYpPgimbLWzx8XhYbA7LeAuwfE=; b=G9G0KSGJIKajWW+rvaNiEd06qFRk7D3iZ33Ur7DaHvOVN1HYM5L7LmPA4IQ9R+A33f E7Dq5ZgAw8lL1Xs4FClZDA1sn3rS5UwUq/LEHUz1Wcp7lZj9eOMCbcMfDOFgLfp8E/GX hxVvyFPUOOl5q2KPlhw4bW3l7+Ll40zwYUgr1SvA0cASx2BuNkuv2Z5D2Fs76bx0Fyat 7yvEkS4WyDi5caQXCQdrJoMZ8scXYJh/YzYyt85NF6c+iw/MWI8VHe+w2Xyle/5eyVpk S4l1/hKOBPlPjWDAgFL/0R+ZgtxNU8H1v6e74T6BLGWCNrmpH5th3o6/5mK1Hqz8id5A FLSw== X-Forwarded-Encrypted: i=1; AHgh+Robakj0bWGCU4UF56dSPO+nPexB1SI/VaxO0p9D8MER51Bg4yNJrwnug1RgIGHETWTN/CK/BuIv0UQ7uV8=@vger.kernel.org X-Gm-Message-State: AOJu0YxKL+F+t1Zex0TyXHLRmAuKjh53q3XcDKF8+//yOetTSVb3s1rP sWF8k7R8n5zy5MzuV/cE75yc+VYzVNMkV12Dj71ao1916lgSxPrHucjNZiA0cTMGra8lYjWDmby XQo2HxbMeSR5R6jzlw1zsl7tJXQnDxiGw5AGfrInC2E4oAS+CI8mprfR3LoR+Oq77jIo= X-Gm-Gg: AR+sD11QJJeSqsDYLQFKKC8+oxy+7w0KZlHKkHBe/S8DwlC73LIt4eKuRoZFltbpRlY BD5gs/eFLVONLefSy5eOCqd1haYi1UXvgpkZHKXcvgrDUpAo8JwEA1wGwxmfwNIGspn2HIGT17N g9RNKKvqc44+5m7oZKknWZB3ucofq+4Uqa+yPtciwgevJd7DH0zdTpWsZZfQN069FA75ZE8xXBK x4lMnPsd1SbYVVRaqIG3CxEhbLmRrHg5MLnM1tAsCn+RGvMmDp4m8UFIg1LkaIw1Ih2lnulbqbJ 8fa3kRqV3Cv5a5xZzbKqoKWNNvitw9LKbAykY1Zm28BXYk7gUS8qs9m4BkFiGq/35RrNE3UA+UO 6u52K1dUYQuxf2Rx0/DBezphgqYap1sv8KeNa7HrLAHAcR5E= X-Received: by 2002:a05:6a00:12e6:b0:846:2f3d:6259 with SMTP id d2e1a72fcca58-84e932c6985mr7407582b3a.57.1785340638995; Wed, 29 Jul 2026 08:57:18 -0700 (PDT) X-Received: by 2002:a05:6a00:12e6:b0:846:2f3d:6259 with SMTP id d2e1a72fcca58-84e932c6985mr7407543b3a.57.1785340638600; Wed, 29 Jul 2026 08:57:18 -0700 (PDT) Received: from localhost (c-73-37-105-206.hsd1.or.comcast.net. [73.37.105.206]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84ea7344ca8sm1211056b3a.21.2026.07.29.08.57.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 29 Jul 2026 08:57:18 -0700 (PDT) From: Rob Clark To: dri-devel@lists.freedesktop.org Cc: linux-arm-msm@vger.kernel.org, freedreno@lists.freedesktop.org, Rob Clark , Sashiko , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Sean Paul , Marijn Suijten , David Airlie , Simona Vetter , linux-kernel@vger.kernel.org (open list) Subject: [PATCH v7 17/17] drm/msm: Fixup invalid overflow check Date: Wed, 29 Jul 2026 08:55:54 -0700 Message-ID: <20260729155609.20190-18-robin.clark@oss.qualcomm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260729155609.20190-1-robin.clark@oss.qualcomm.com> References: <20260729155609.20190-1-robin.clark@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI5MDEyNyBTYWx0ZWRfX+slARIkvZOvC 4X+O0KhUccs4fYR2TmzyvhKObJ6Xh6wGOWxDDu5z7EbL2abh5yZAbqcsNJzRbwu1G8xX+FI9bbU OsH07wBIOntbdFPK8nU94x0ouoC2y3k2IKK15IYdFRozqwqmAxDfeKlkxfc6ZKGSdQR/mId2lTF tiAWznDTF3uOvffxLXUNw3NpIgOS/ABISCsAchFyJUh0WHPH/dPffTp/ZfK8YfUN6/yRyg+vNEL zPgqRfHLpW5rMRBHxlbVsvtpKkKAOcIieNOGJcZkWPasXWE1YwVe+WsLFx6nTjRBoZJ4uXds7Tu tB+ixoLA4t7UG/8T32J1S8kp/hREZw97ZOaqOkJifzlZUebaEZ44K9fIEpOnqrSWxVaElP9JwV+ hdKbILggoQ5YlV6DNGX5/mKuCjL97mdV9LVs5Ai+2D6OaaHQASF8EFvMxRf79DAPdxGB5gvwUkT bOC3kJ6TUQLCUHj+4fQ== X-Proofpoint-GUID: Kb2nJueKeJUIcF4ZyWYpxLaA-jJ8Z9dl X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI5MDEyNyBTYWx0ZWRfX7RUJbvqx12xk uKNM3eSJ6dtLWA5junqgT3NipI7qX6itmqPJ7iGfTQ1uFAfQOqv8UVeWOweganXiXREpWYe/hsF iySDOwRp+m2n3kvXSkluu2xWHvN3Vs0= X-Authority-Analysis: v=2.4 cv=ONYXGyaB c=1 sm=1 tr=0 ts=6a6a22df cx=c_pps a=mDZGXZTwRPZaeRUbqKGCBw==:117 a=19Wyn7e3V/0aNffMjNCMQw==:17 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=Um2Pa8k9VHT-vaBCBUpS:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=uVkA5J_fsNn9jy38BCIA:9 a=zc0IvFSfCIW2DFIPzwfm:22 X-Proofpoint-ORIG-GUID: Kb2nJueKeJUIcF4ZyWYpxLaA-jJ8Z9dl X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-29_06,2026-07-29_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 spamscore=0 adultscore=0 priorityscore=1501 suspectscore=0 bulkscore=0 clxscore=1015 phishscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607290127 On overflow struct_size() would return SIZE_MAX. But kzalloc() (and friends) check this already, so we can just remove the check. On the other hand, we should be using the overflow helpers to calculate the cmd array size. Reported-by: Sashiko Signed-off-by: Rob Clark --- drivers/gpu/drm/msm/msm_gem_submit.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c index 6b0bee6c39bc..5862db05297a 100644 --- a/drivers/gpu/drm/msm/msm_gem_submit.c +++ b/drivers/gpu/drm/msm/msm_gem_submit.c @@ -36,14 +36,11 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev, { static atomic_t ident = ATOMIC_INIT(0); struct msm_gem_submit *submit; - uint64_t sz; + size_t sz; int ret; - sz = struct_size(submit, bos, nr_bos) + - ((u64)nr_cmds * sizeof(submit->cmd[0])); - - if (sz > SIZE_MAX) - return ERR_PTR(-ENOMEM); + sz = size_add(struct_size(submit, bos, nr_bos), + array_size(sizeof(submit->cmd[0]), nr_cmds)); submit = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN); if (!submit) -- 2.55.0