diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-08-06 07:43:01 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-08-06 07:43:00 -0700 |
| commit | 977b2f70550f6b1bb1612b5b1f376d152df1acaa (patch) | |
| tree | dc74240a24d1eeb585ebad52ba41ef5403da477d | |
| parent | ca652b3d74c674ee4847ce56199889fd247106e6 (diff) | |
| parent | fde778c14ade8e7666b30e7777f84a01ea43ea7b (diff) | |
Merge "msm: kgsl: Fix integer overflow in _load_gpmu_firmware"
| -rw-r--r-- | drivers/gpu/msm/adreno_a5xx.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/gpu/msm/adreno_a5xx.c b/drivers/gpu/msm/adreno_a5xx.c index 466c42877b3f..f4dfae1a115f 100644 --- a/drivers/gpu/msm/adreno_a5xx.c +++ b/drivers/gpu/msm/adreno_a5xx.c @@ -715,6 +715,10 @@ static int _load_gpmu_firmware(struct adreno_device *adreno_dev) if (ret) goto err; + /* Integer overflow check for cmd_size */ + if (data[2] > (data[0] - 2)) + goto err; + cmds = data + data[2] + 3; cmd_size = data[0] - data[2] - 2; |