Skip to content
Snippets Groups Projects
Commit c6296479 authored by shunmin_wang's avatar shunmin_wang Committed by Carol_Jiang
Browse files

msm: kgsl: Cast perfcounter query count to an unsigned int (CVE-2016-2062)

In adreno_perfcounter_query_group() make sure to cast the user passed
count to an unsigned int before comparing it to the group count.
Otherwise the user count could be interpeted as a signed int and
hilarity ensues.

Change-Id: I743d50234780a1a6e9495c3911a83e3624a0347d
Reviewed-on: http://mcrd1-22-pc.corpnet.asus/code-review/master/231414


Reviewed-by: default avatarshunmin_wang <shunmin_wang@asus.com>
Tested-by: default avatarshunmin_wang <shunmin_wang@asus.com>
parent fd562173
No related branches found
No related tags found
No related merge requests found
......@@ -517,7 +517,7 @@ int adreno_perfcounter_query_group(struct adreno_device *adreno_dev,
return 0;
}
t = min_t(int, group->reg_count, count);
t = min_t(unsigned int, group->reg_count, count);
buf = kmalloc(t * sizeof(unsigned int), GFP_KERNEL);
if (buf == NULL) {
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment