diff options
| author | Rajesh Kemisetti <rajeshk@codeaurora.org> | 2015-12-10 16:00:00 +0530 |
|---|---|---|
| committer | David Keitel <dkeitel@codeaurora.org> | 2016-03-23 21:14:53 -0700 |
| commit | b9ad61fb8effee1f023a18a7dfdfe5dce2c7564d (patch) | |
| tree | f7c7f156e1978924566ba1abe2d594f730a9f9e0 /drivers/gpu/msm/kgsl_iommu.c | |
| parent | 9c23d30f6033eaa1780c2a85c1b9e499cb441329 (diff) | |
msm: kgsl: Add missing check for size against lower VA
_get_unmapped_area_topdown() subtracts the requested size
from lower entry base without really checking its value.
This leads to overflow while working at boundary conditions.
Add a condition to check entry base with the size and proceed.
Change-Id: Ic695da683b11de35c7c4b8936a35d693dc8fa452
Signed-off-by: Rajesh Kemisetti <rajeshk@codeaurora.org>
Diffstat (limited to 'drivers/gpu/msm/kgsl_iommu.c')
| -rw-r--r-- | drivers/gpu/msm/kgsl_iommu.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/msm/kgsl_iommu.c b/drivers/gpu/msm/kgsl_iommu.c index 1d9bc378affb..a0e84472c8e8 100644 --- a/drivers/gpu/msm/kgsl_iommu.c +++ b/drivers/gpu/msm/kgsl_iommu.c @@ -1661,7 +1661,7 @@ static uint64_t _get_unmapped_area_topdown(struct kgsl_pagetable *pagetable, * the bottom of the previous one */ - if (offset < end) { + if ((end > size) && (offset < end)) { uint64_t chunk = (end - size) & mask; if (chunk >= offset) |