msm: kgsl: Add missing check for alloc size(CVE-2016-2468)
In _kgsl_sharedmem_page_alloc(), check for boundary limits
of requested alloc size before honoring.
Change-Id: Ib76926a6c5994065d5c8f4a9e36b34dff5d4596b
Reviewed-on: http://mcrd1-22-pc.corpnet.asus/code-review/master/238963
Reviewed-by: shunmin_wang <shunmin_wang@asus.com>
Tested-by: shunmin_wang <shunmin_wang@asus.com>
Reviewed-by: Carol_Jiang <carol_jiang@asus.com>
diff --git a/drivers/gpu/msm/kgsl_sharedmem.c b/drivers/gpu/msm/kgsl_sharedmem.c
index b62c3a3..73f9ed2 100644
--- a/drivers/gpu/msm/kgsl_sharedmem.c
+++ b/drivers/gpu/msm/kgsl_sharedmem.c
@@ -576,6 +576,10 @@
unsigned int align;
int step = ((VMALLOC_END - VMALLOC_START)/8) >> PAGE_SHIFT;
+ size = PAGE_ALIGN(size);
+ if (size == 0 || size > UINT_MAX)
+ return -EINVAL;
+
align = (memdesc->flags & KGSL_MEMALIGN_MASK) >> KGSL_MEMALIGN_SHIFT;
page_size = get_page_size(size, align);
