media: videobuf2-dma-sg: Prevent size from overflowing
authorSakari Ailus <sakari.ailus@linux.intel.com>
Wed, 12 Dec 2018 12:44:14 +0000 (07:44 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 26 Jul 2019 07:14:24 +0000 (09:14 +0200)
commit87bae91a0fe9e76b69e5110ca35caeba29dcc182
treea52932d49f09bcafcc61df372a66c433e41ed75e
parentcb2e2b0ae55421b320830dbd5d860aadce86bf3e
media: videobuf2-dma-sg: Prevent size from overflowing

commit 14f28f5cea9e3998442de87846d1907a531b6748 upstream.

buf->size is an unsigned long; casting that to int will lead to an
overflow if buf->size exceeds INT_MAX.

Fix this by changing the type to unsigned long instead. This is possible
as the buf->size is always aligned to PAGE_SIZE, and therefore the size
will never have values lesser than 0.

Note on backporting to stable: the file used to be under
drivers/media/v4l2-core, it was moved to the current location after 4.14.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/media/common/videobuf2/videobuf2-dma-sg.c