drm/msm: fix an integer overflow test

[karo-tx-linux.git] / drivers / gpu / drm / msm / msm_gem_submit.c

diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 7832e6421d250d0bd78400057e46dce07dc2d18c..8095658e8cb49414ca95e020a0991d729b2458f2 100644 (file)
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -31,11 +31,14 @@
 #define BO_PINNED   0x2000
 
 static struct msm_gem_submit *submit_create(struct drm_device *dev,
-               struct msm_gpu *gpu, int nr_bos, int nr_cmds)
+               struct msm_gpu *gpu, uint32_t nr_bos, uint32_t nr_cmds)
 {
        struct msm_gem_submit *submit;
-       int sz = sizeof(*submit) + (nr_bos * sizeof(submit->bos[0])) +
-                       (nr_cmds * sizeof(*submit->cmd));
+       uint64_t sz = sizeof(*submit) + ((u64)nr_bos * sizeof(submit->bos[0])) +
+               ((u64)nr_cmds * sizeof(submit->cmd[0]));
+
+       if (sz > SIZE_MAX)
+               return NULL;
 
        submit = kmalloc(sz, GFP_TEMPORARY | __GFP_NOWARN | __GFP_NORETRY);
        if (!submit)
@@ -158,7 +161,7 @@ static void submit_unlock_unpin_bo(struct msm_gem_submit *submit, int i)
        struct msm_gem_object *msm_obj = submit->bos[i].obj;
 
        if (submit->bos[i].flags & BO_PINNED)
-               msm_gem_put_iova(&msm_obj->base, submit->gpu->id);
+               msm_gem_put_iova(&msm_obj->base, submit->gpu->aspace);
 
        if (submit->bos[i].flags & BO_LOCKED)
                ww_mutex_unlock(&msm_obj->resv->lock);
@@ -245,8 +248,8 @@ static int submit_pin_objects(struct msm_gem_submit *submit)
                uint64_t iova;
 
                /* if locking succeeded, pin bo: */
-               ret = msm_gem_get_iova_locked(&msm_obj->base,
-                               submit->gpu->id, &iova);
+               ret = msm_gem_get_iova(&msm_obj->base,
+                               submit->gpu->aspace, &iova);
 
                if (ret)
                        break;
@@ -301,7 +304,7 @@ static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *ob
        /* For now, just map the entire thing.  Eventually we probably
         * to do it page-by-page, w/ kmap() if not vmap()d..
         */
-       ptr = msm_gem_get_vaddr_locked(&obj->base);
+       ptr = msm_gem_get_vaddr(&obj->base);
 
        if (IS_ERR(ptr)) {
                ret = PTR_ERR(ptr);
@@ -359,7 +362,7 @@ static int submit_reloc(struct msm_gem_submit *submit, struct msm_gem_object *ob
        }
 
 out:
-       msm_gem_put_vaddr_locked(&obj->base);
+       msm_gem_put_vaddr(&obj->base);
 
        return ret;
 }