drm: limit to INT_MAX in create_blob ioctl

[mirror_ubuntu-bionic-kernel.git] / drivers / gpu / drm / drm_property.c

diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
index d2375cf783d3c7926ea1860244f6f24c8b59d750..5798c1b2bb518f97bd70b4d1054cd0d26038a837 100644 (file)
--- a/drivers/gpu/drm/drm_property.c
+++ b/drivers/gpu/drm/drm_property.c
@@ -540,7 +540,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length,
        struct drm_property_blob *blob;
        int ret;
 
-       if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))
+       if (!length || length > INT_MAX - sizeof(struct drm_property_blob))
                return ERR_PTR(-EINVAL);
 
        blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);