diff options
| author | Mikko Perttunen <mperttunen@nvidia.com> | 2017-01-27 09:32:20 +0200 |
|---|---|---|
| committer | Winnie Hsu <whsu@nvidia.com> | 2017-05-05 14:54:58 -0700 |
| commit | 698ba25737bead5af8dc5bd962d3378400cb39ae (patch) | |
| tree | 71dc3d21e2352dfc5ccd27eee9b0ef1c6c03b643 /drivers | |
| parent | 7c7162fbc912dd6c751d929d188b27f71bd2ede3 (diff) | |
video: tegra: host: Fix overflow issue allocation
Change kmalloc to kmalloc_array to prevent overflow issues
caused by large values supplied by user.
Based on "video: tegra: host: Fix overflow issues in allocation"
in nvhost/.
Coverity ID 27942
Bug 1856419
Change-Id: I5e96d0ec184543782dfe8814ad7e856b3b71221c
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Reviewed-on: http://git-master/r/1295062
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/video/tegra/host/host1x/host1x.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/video/tegra/host/host1x/host1x.c b/drivers/video/tegra/host/host1x/host1x.c index 5631189c354f..522219484286 100644 --- a/drivers/video/tegra/host/host1x/host1x.c +++ b/drivers/video/tegra/host/host1x/host1x.c @@ -206,11 +206,11 @@ static int nvhost_ioctl_ctrl_sync_fence_create(struct nvhost_ctrl_userctx *ctx, name[0] = '\0'; } - pts = kmalloc(sizeof(*pts) * args->num_pts, GFP_KERNEL); + pts = kmalloc_array(args->num_pts, sizeof(*pts), GFP_KERNEL); if (!pts) return -ENOMEM; - + /* Multiplication overflow would have errored in kmalloc_array */ if (copy_from_user(pts, args_pts, sizeof(*pts) * args->num_pts)) { err = -EFAULT; goto out; |