Re: [PATCH] drm/nouveau/nv04: check cursor buffer object size before upload
| Newsgroups | org.freedesktop.lists.nouveau,org.freedesktop.lists.dri-devel,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Thu, 2026-08-13 at 18:35 +0800, Zhenhao Wan wrote:
> struct drm_file *file_priv,
> return -ENOENT;
> cursor = nouveau_gem_object(gem);
>
> + if (gem->size < width * height * 4) {
> + ret = -EINVAL;
> + goto out;
> + }
> +
A good start - but width and/or height could be UINT32_MAX, so a caller
could still overflow width or height. Would you mind adding an overflow
multiply check?
> ret = nouveau_bo_map(cursor);
> if (ret)
> goto out;
>
> ---
> base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
> change-id: 20260813-nouveau-nv04-cursor-oob-ad2b6001de3d
>
> Best regards,
> --
> Zhenhao Wan <[email protected]>