drm/msm: fix an integer overflow test
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 30 Jun 2017 07:59:15 +0000 (10:59 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 8 Nov 2017 09:06:28 +0000 (10:06 +0100)
commitded34f972348b0f252256bee161839c1aa5d8ae4
tree36486c9708a07b37cbcbee0c193d0f8dbe5b0d6b
parent031b02bc16aeeb34c8038026cbbca1e6430c9d75
drm/msm: fix an integer overflow test

commit 65e93108891e571f177c202add9288eda9ac4100 upstream.

We recently added an integer overflow check but it needs an additional
tweak to work properly on 32 bit systems.

The problem is that we're doing the right hand side of the assignment as
type unsigned long so the max it will have an integer overflow instead
of being larger than SIZE_MAX.  That means the "sz > SIZE_MAX" condition
is never true even on 32 bit systems.  We need to first cast it to u64
and then do the math.

Fixes: 4a630fadbb29 ("drm/msm: Fix potential buffer overflow issue")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/gpu/drm/msm/msm_gem_submit.c