summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorMikko Perttunen <mperttunen@nvidia.com>2017-01-27 09:32:20 +0200
committerWinnie Hsu <whsu@nvidia.com>2017-05-05 14:54:58 -0700
commit698ba25737bead5af8dc5bd962d3378400cb39ae (patch)
tree71dc3d21e2352dfc5ccd27eee9b0ef1c6c03b643 /drivers
parent7c7162fbc912dd6c751d929d188b27f71bd2ede3 (diff)
video: tegra: host: Fix overflow issue allocation
Change kmalloc to kmalloc_array to prevent overflow issues caused by large values supplied by user. Based on "video: tegra: host: Fix overflow issues in allocation" in nvhost/. Coverity ID 27942 Bug 1856419 Change-Id: I5e96d0ec184543782dfe8814ad7e856b3b71221c Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Reviewed-on: http://git-master/r/1295062 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/video/tegra/host/host1x/host1x.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/video/tegra/host/host1x/host1x.c b/drivers/video/tegra/host/host1x/host1x.c
index 5631189c354f..522219484286 100644
--- a/drivers/video/tegra/host/host1x/host1x.c
+++ b/drivers/video/tegra/host/host1x/host1x.c
@@ -206,11 +206,11 @@ static int nvhost_ioctl_ctrl_sync_fence_create(struct nvhost_ctrl_userctx *ctx,
name[0] = '\0';
}
- pts = kmalloc(sizeof(*pts) * args->num_pts, GFP_KERNEL);
+ pts = kmalloc_array(args->num_pts, sizeof(*pts), GFP_KERNEL);
if (!pts)
return -ENOMEM;
-
+ /* Multiplication overflow would have errored in kmalloc_array */
if (copy_from_user(pts, args_pts, sizeof(*pts) * args->num_pts)) {
err = -EFAULT;
goto out;