Re: [PATCH 1/2] drm/msm/gem: Fix VM_BIND range check

[Rob Clark]

On Mon, Nov 2, 2026 at 5:59 AM Rob Clark <rob.clark@xxxxxxxxxxxxxxxx> wrote:
>
> On Mon, Nov 2, 2026 at 1:40 AM Konrad Dybcio
> <konrad.dybcio@xxxxxxxxxxxxxxxx> wrote:
> >
> > On 11/1/26 6:49 PM, Rob Clark wrote:
> > > Use size_add() to guard against overflow.
> > >
> > > Reported-by: Konrad Dybcio <konrad.dybcio@xxxxxxxxxxxxxxxx>
> > > Fixes: 3a3bef68a6c1 ("drm/msm: Fix missing VM_BIND offset/range validation")
> > > Signed-off-by: Rob Clark <robin.clark@xxxxxxxxxxxxxxxx>
> > > ---
> > >  drivers/gpu/drm/msm/msm_gem_vma.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/gpu/drm/msm/msm_gem_vma.c b/drivers/gpu/drm/msm/msm_gem_vma.c
> > > index f687a629629d..16b3870d5e90 100644
> > > --- a/drivers/gpu/drm/msm/msm_gem_vma.c
> > > +++ b/drivers/gpu/drm/msm/msm_gem_vma.c
> > > @@ -1118,7 +1118,7 @@ vm_bind_job_lookup_ops(struct msm_vm_bind_job *job, struct drm_msm_vm_bind *args
> > >               op->obj = obj;
> > >               cnt++;
> > >
> > > -             if ((op->range + op->obj_offset) > obj->size) {
> > > +             if (size_add(op->range, op->obj_offset) > obj->size) {
> >
> > GPT and Sashiko are unhappy about what this does on 32b
>
> Considering that we can't have >4gb BOs on 32b, I think the concerns
> are probably unwarranted.  But yes, I do look at Sashiko's reports

Probably we should add checks that obj_offset/range are not more than SIZE_MAX?

BR,
-R