Linux Kernel Integer Overflow Vulnerability in DRM MSM GEM Submissions

A vulnerability allowing integer overflow has been addressed in the Linux kernel's Direct Rendering Manager (DRM) for the MSM (Mobile Station Modem) graphics execution manager. The issue arose in the 'msm_ioctl_gem_submit()' function, where user-supplied 'submit->cmd[i].size' and 'submit->cmd[i].offset' variables, both of type u32, could lead to an integer wrapping bug. The vulnerability has been mitigated by using 'size_add()' to prevent such overflow.

Impact

Exploitation of this vulnerability could lead to an integer overflow, potentially allowing for memory corruption or other unintended behavior.