@@ -142,11 +142,16 @@ nvif_object_mthd(struct nvif_object *object, u32 mthd, void *data, u32 size)
142142 struct nvif_ioctl_v0 ioctl ;
143143 struct nvif_ioctl_mthd_v0 mthd ;
144144 } * args ;
145+ u32 args_size ;
145146 u8 stack [128 ];
146147 int ret ;
147148
148- if (sizeof (* args ) + size > sizeof (stack )) {
149- if (!(args = kmalloc (sizeof (* args ) + size , GFP_KERNEL )))
149+ if (check_add_overflow (sizeof (* args ), size , & args_size ))
150+ return - ENOMEM ;
151+
152+ if (args_size > sizeof (stack )) {
153+ args = kmalloc (args_size , GFP_KERNEL );
154+ if (!args )
150155 return - ENOMEM ;
151156 } else {
152157 args = (void * )stack ;
@@ -157,7 +162,7 @@ nvif_object_mthd(struct nvif_object *object, u32 mthd, void *data, u32 size)
157162 args -> mthd .method = mthd ;
158163
159164 memcpy (args -> mthd .data , data , size );
160- ret = nvif_object_ioctl (object , args , sizeof ( * args ) + size , NULL );
165+ ret = nvif_object_ioctl (object , args , args_size , NULL );
161166 memcpy (data , args -> mthd .data , size );
162167 if (args != (void * )stack )
163168 kfree (args );
@@ -276,7 +281,15 @@ nvif_object_ctor(struct nvif_object *parent, const char *name, u32 handle,
276281 object -> map .size = 0 ;
277282
278283 if (parent ) {
279- if (!(args = kmalloc (sizeof (* args ) + size , GFP_KERNEL ))) {
284+ u32 args_size ;
285+
286+ if (check_add_overflow (sizeof (* args ), size , & args_size )) {
287+ nvif_object_dtor (object );
288+ return - ENOMEM ;
289+ }
290+
291+ args = kmalloc (args_size , GFP_KERNEL );
292+ if (!args ) {
280293 nvif_object_dtor (object );
281294 return - ENOMEM ;
282295 }
@@ -293,8 +306,7 @@ nvif_object_ctor(struct nvif_object *parent, const char *name, u32 handle,
293306 args -> new .oclass = oclass ;
294307
295308 memcpy (args -> new .data , data , size );
296- ret = nvif_object_ioctl (parent , args , sizeof (* args ) + size ,
297- & object -> priv );
309+ ret = nvif_object_ioctl (parent , args , args_size , & object -> priv );
298310 memcpy (data , args -> new .data , size );
299311 kfree (args );
300312 if (ret == 0 )
0 commit comments