diff options
| author |   jsg <jsg@openbsd.org> | 2020-01-10 02:10:59 +0000 |
|---|---|---|
| committer | jsg <jsg@openbsd.org> | 2020-01-10 02:10:59 +0000 |
| commit | 25dc994c259f5c0a05fae4f8c57787f4ea7fd3a2 (patch) | |
| tree | 0235ae7e0a2d6b938b0bf2d850153bf5e7ddee7e | |
| parent | drm/amd/display: Fixed kernel panic when booting with DP-to-HDMI dongle (diff) | |
| download | wireguard-openbsd-25dc994c259f5c0a05fae4f8c57787f4ea7fd3a2.tar.xz wireguard-openbsd-25dc994c259f5c0a05fae4f8c57787f4ea7fd3a2.zip | |
drm: limit to INT_MAX in create_blob ioctl
From Daniel Vetter
85b1e127aa577f7035b998b8c712bb6a36f02b14 in linux 4.19.y/4.19.94
5bf8bec3f4ce044a223c40cbce92590d938f0e9c in mainline linux
| -rw-r--r-- | sys/dev/pci/drm/drm_property.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/dev/pci/drm/drm_property.c b/sys/dev/pci/drm/drm_property.c index cdb10f885a4..69dfed57c2f 100644 --- a/sys/dev/pci/drm/drm_property.c +++ b/sys/dev/pci/drm/drm_property.c @@ -556,7 +556,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, struct drm_property_blob *blob; int ret; - if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob)) + if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) return ERR_PTR(-EINVAL); blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); |