Re: [PATCH 1/2] drm/msm/gem: Fix VM_BIND range check

[Konrad Dybcio]

On 11/2/26 4:18 PM, Rob Clark wrote:
> On Mon, Nov 2, 2026 at 5:59 AM Rob Clark <rob.clark@xxxxxxxxxxxxxxxx> wrote:
>>
>> On Mon, Nov 2, 2026 at 1:40 AM Konrad Dybcio
>> <konrad.dybcio@xxxxxxxxxxxxxxxx> wrote:
>>>
>>> On 11/1/26 6:49 PM, Rob Clark wrote:
>>>> Use size_add() to guard against overflow.
>>>>
>>>> Reported-by: Konrad Dybcio <konrad.dybcio@xxxxxxxxxxxxxxxx>
>>>> Fixes: 3a3bef68a6c1 ("drm/msm: Fix missing VM_BIND offset/range validation")
>>>> Signed-off-by: Rob Clark <robin.clark@xxxxxxxxxxxxxxxx>
>>>> ---
>>>>  drivers/gpu/drm/msm/msm_gem_vma.c | 2 +-
>>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>>
>>>> diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
>>>> index f687a629629d..16b3870d5e90 100644
>>>> --- a/drivers/gpu/drm/msm/msm_gem_vma.c
>>>> +++ b/drivers/gpu/drm/msm/msm_gem_vma.c
>>>> @@ -1118,7 +1118,7 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args
>>>>               op->obj = obj;
>>>>               cnt++;
>>>>
>>>> -             if ((op->range + op->obj_offset) > obj->size) {
>>>> +             if (size_add(op->range, op->obj_offset) > obj->size) {
>>>
>>> GPT and Sashiko are unhappy about what this does on 32b
>>
>> Considering that we can't have >4gb BOs on 32b, I think the concerns
>> are probably unwarranted.  But yes, I do look at Sashiko's reports
> 
> Probably we should add checks that obj_offset/range are not more than SIZE_MAX?

Wouldn't hurt

Konrad