[PATCH] drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

[Dan Carpenter]

The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32
values that come from the user via the submit_lookup_cmds() function.
This addition could lead to an integer wrapping bug so use size_add()
to prevent that.

Fixes: 198725337ef1 ("drm/msm: fix cmdstream size check")
Cc: sta...@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpen...@linaro.org>
---
 drivers/gpu/drm/msm/msm_gem_submit.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c 
b/drivers/gpu/drm/msm/msm_gem_submit.c
index fba78193127d..f775638d239a 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -787,8 +787,7 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
                        goto out;
 
                if (!submit->cmd[i].size ||
-                       ((submit->cmd[i].size + submit->cmd[i].offset) >
-                               obj->size / 4)) {
+                   (size_add(submit->cmd[i].size, submit->cmd[i].offset) > 
obj->size / 4)) {
                        SUBMIT_ERROR(submit, "invalid cmdstream size: %u\n", 
submit->cmd[i].size * 4);
                        ret = -EINVAL;
                        goto out;
-- 
2.45.2