From: jsg <jsg@openbsd.org>
Date: Fri, 28 Jul 2023 06:47:10 +0000 (+0000)
Subject: drm/radeon: Fix integer overflow in radeon_cs_parser_init
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=5cc96e76ac950d93e07573405ed23bae946dc310;p=openbsd

drm/radeon: Fix integer overflow in radeon_cs_parser_init

From hackyzh002
2e1be420b86980c25a75325e90dfc3fc73126f61 in linux-6.1.y/6.1.42
f828b681d0cd566f86351c0b913e6cb6ed8c7b9c in mainline linux
---

diff --git a/sys/dev/pci/drm/radeon/radeon_cs.c b/sys/dev/pci/drm/radeon/radeon_cs.c
index 820d50c3ca5..a185e1f00ca 100644
--- a/sys/dev/pci/drm/radeon/radeon_cs.c
+++ b/sys/dev/pci/drm/radeon/radeon_cs.c
@@ -274,7 +274,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
 {
 	struct drm_radeon_cs *cs = data;
 	uint64_t *chunk_array_ptr;
-	unsigned size, i;
+	u64 size;
+	unsigned i;
 	u32 ring = RADEON_CS_RING_GFX;
 	s32 priority = 0;