diff mbox series

drm: Use array_size() in call to copy_from_user() in drm_mode_dirtyfb_ioctl()

Message ID 20241115002748.7200-1-zichenxie0106@gmail.com (mailing list archive)
State New
Headers show
Series drm: Use array_size() in call to copy_from_user() in drm_mode_dirtyfb_ioctl() | expand

Commit Message

Gax-c Nov. 15, 2024, 12:27 a.m. UTC 
From: Zichen Xie <zichenxie0106@gmail.com>

Like commit ac19c4c3d02e ("bcachefs: Use array_size() in call to
copy_from_user()"), it's a safer way to use helper array_size() in
copy_from_user() to avoid potential overflow issues.

Fixes: 7520a277d97b ("drm: Extract drm_framebuffer.[hc]")
Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
---
 drivers/gpu/drm/drm_framebuffer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index 888aadb6a4ac..323fb194ca17 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -752,7 +752,7 @@  int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
 		}
 
 		ret = copy_from_user(clips, clips_ptr,
-				     num_clips * sizeof(*clips));
+				     array_size(num_clips, sizeof(*clips)));
 		if (ret) {
 			ret = -EFAULT;
 			goto out_err2;