This is supposed to test for integer overflow but it is wrong and
unnecessary. The size_add()/mul() macros return SIZE_MAX when there is
an integer overflow. This code saves the SIZE_MAX to a u64 and then
tests if the result is greater than SIZE_MAX which it never will be.
Fortunately, when we try to allocate SIZE_MAX bytes the allocation
will fail. We even pass __GFP_NOWARN so the allocation fails
harmlessly and quietly.
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/697596/
Link: https://lore.kernel.org/r/aWAMIhZLxUcecbLd@stanley.mountain
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
struct msm_gpu_submitqueue *queue, uint32_t nr_ops)
{
struct msm_vm_bind_job *job;
- uint64_t sz;
int ret;
- sz = struct_size(job, ops, nr_ops);
-
- if (sz > SIZE_MAX)
- return ERR_PTR(-ENOMEM);
-
- job = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN);
+ job = kzalloc(struct_size(job, ops, nr_ops), GFP_KERNEL | __GFP_NOWARN);
if (!job)
return ERR_PTR(-ENOMEM);