diff options
| author | Thomas Zimmermann <tzimmermann@suse.de> | 2026-06-18 11:41:58 +0300 |
|---|---|---|
| committer | Thomas Zimmermann <tzimmermann@suse.de> | 2026-06-22 12:03:21 +0300 |
| commit | b771974988ec7ce077a7246fa0fa588c246fe581 (patch) | |
| tree | 019a0216890f2e5a49b0023858de401376d7c4d2 | |
| parent | 134844856c399bfa9462a159dcf860bfdb748055 (diff) | |
| download | linux-b771974988ec7ce077a7246fa0fa588c246fe581.tar.xz | |
drm/sysfb: Avoid possible truncation with calculating visible size
Calculating the visible size of the system framebuffer can result in
truncation of the result. The calculation uses 32-bit arithmetics,
which can overflow if the values for height and stride are large. Fix
the issue by multiplying with mul_u32_u32().
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
Fixes: a84eb6abe2b6 ("drm/sysfb: Add vesadrm for VESA displays")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/dri-devel/20260617114027.1F2A71F000E9@smtp.kernel.org/
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.16+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patch.msgid.link/20260618084327.46567-3-tzimmermann@suse.de
| -rw-r--r-- | drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c b/drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c index 361b7233600c..8b14eaa304c0 100644 --- a/drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c +++ b/drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c @@ -2,6 +2,7 @@ #include <linux/export.h> #include <linux/limits.h> +#include <linux/math64.h> #include <linux/minmax.h> #include <linux/screen_info.h> @@ -67,7 +68,7 @@ EXPORT_SYMBOL(drm_sysfb_get_stride_si); u64 drm_sysfb_get_visible_size_si(struct drm_device *dev, const struct screen_info *si, unsigned int height, unsigned int stride, u64 size) { - u64 vsize = height * stride; + u64 vsize = mul_u32_u32(height, stride); return drm_sysfb_get_validated_size0(dev, "visible size", vsize, size); } |