Re: [PATCH 2/3] videobuf2-dma-sg: Prevent size from overflowing

[Laurent Pinchart <laurent.pinchart@ideasonboard.com>]

Hi Sakari,

Thank you for the patch.

On Thursday, 13 December 2018 12:40:05 EET Sakari Ailus wrote:
> buf->size is an unsigned long; casting that to int will lead to an
> overflow if buf->size exceeds INT_MAX.
> 
> Fix this by changing the type to unsigned long instead. This is possible
> as the buf->size is always aligned to PAGE_SIZE, and therefore the size
> will never have values lesser than 0.

This feels a bit fragile to me. We at least need a big comment in the code to 
explain this. Another option would be a size -= min(..., size) just to make 
sure.

> Note on backporting to stable: the file used to be under
> drivers/media/v4l2-core, it was moved to the current location after 4.14.
> 
> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
> Cc: stable@vger.kernel.org
> ---
>  drivers/media/common/videobuf2/videobuf2-dma-sg.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
> b/drivers/media/common/videobuf2/videobuf2-dma-sg.c index
> 015e737095cdd..e9bfea986cc47 100644
> --- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
> +++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
> @@ -59,7 +59,7 @@ static int vb2_dma_sg_alloc_compacted(struct
> vb2_dma_sg_buf *buf, gfp_t gfp_flags)
>  {
>  	unsigned int last_page = 0;
> -	int size = buf->size;
> +	unsigned long size = buf->size;
> 
>  	while (size > 0) {
>  		struct page *pages;

-- 
Regards,

Laurent Pinchart