diff options
| author | Ville Syrjälä <ville.syrjala@linux.intel.com> | 2024-11-29 09:50:13 +0300 |
|---|---|---|
| committer | Ville Syrjälä <ville.syrjala@linux.intel.com> | 2025-01-13 19:37:02 +0300 |
| commit | b9ec6793355647bcbcecb21ef6cd179469d3f191 (patch) | |
| tree | 65981df2117000dda7caa305f18e06bb54e77f19 | |
| parent | 0bd39e303ee705c4b0549e2826c42c1d7b849898 (diff) | |
| download | linux-b9ec6793355647bcbcecb21ef6cd179469d3f191.tar.xz | |
drm/i915/fb: Check that the clear color fits within the BO
Make sure the user supplied offset[] for the clear color plane
fits within the actual BO. Note that we use tile units to track
the size here. All the other color/aux planes are already
being checked correctly.
Cc: Sagar Ghuge <sagar.ghuge@intel.com>
Cc: Nanley Chery <nanley.g.chery@intel.com>
Cc: Xi Ruoyao <xry111@xry111.site>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241129065014.8363-4-ville.syrjala@linux.intel.com
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
| -rw-r--r-- | drivers/gpu/drm/i915/display/intel_fb.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/gpu/drm/i915/display/intel_fb.c b/drivers/gpu/drm/i915/display/intel_fb.c index e478d412785e..9f7f1b9f3275 100644 --- a/drivers/gpu/drm/i915/display/intel_fb.c +++ b/drivers/gpu/drm/i915/display/intel_fb.c @@ -1694,6 +1694,8 @@ int intel_fill_fb_info(struct drm_i915_private *i915, struct intel_framebuffer * * arithmetic related to alignment and offset calculation. */ if (is_gen12_ccs_cc_plane(&fb->base, i)) { + unsigned int end; + if (!IS_ALIGNED(fb->base.offsets[i], 64)) { drm_dbg_kms(&i915->drm, "fb misaligned clear color plane %d offset (0x%x)\n", @@ -1701,6 +1703,14 @@ int intel_fill_fb_info(struct drm_i915_private *i915, struct intel_framebuffer * return -EINVAL; } + if (check_add_overflow(fb->base.offsets[i], 64, &end)) { + drm_dbg_kms(&i915->drm, + "fb bad clear color plane %d offset (0x%x)\n", + i, fb->base.offsets[i]); + return -EINVAL; + } + + max_size = max(max_size, DIV_ROUND_UP(end, tile_size)); continue; } |