| Message ID | 20231025130946.119957-1-paul.kocialkowski@bootlin.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/2] drm/logicvc: Avoid possible overflow in layer buffer setup variables | expand |
Hi folks, On Wed 25 Oct 23, 15:09, Paul Kocialkowski wrote: > The buffer_sel, voffset and hoffset values are calculated from u32 > values and might overflow under certain conditions. > > Move them to u32 definitions instead of u8/u16 to avoid the issue. Any chance to get a quick review on this simple fixup (and the next one)? I can certainly push them myself after that. Thanks, Paul > Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > Fixes: efeeaefe9be5 ("drm: Add support for the LogiCVC display controller") > --- > drivers/gpu/drm/logicvc/logicvc_layer.c | 6 +++--- > drivers/gpu/drm/logicvc/logicvc_layer.h | 6 +++--- > 2 files changed, 6 insertions(+), 6 deletions(-) > > diff --git a/drivers/gpu/drm/logicvc/logicvc_layer.c b/drivers/gpu/drm/logicvc/logicvc_layer.c > index 464000aea765..eea22379d042 100644 > --- a/drivers/gpu/drm/logicvc/logicvc_layer.c > +++ b/drivers/gpu/drm/logicvc/logicvc_layer.c > @@ -268,9 +268,9 @@ int logicvc_layer_buffer_find_setup(struct logicvc_drm *logicvc, > u32 layer_stride = layer_bytespp * logicvc->config.row_stride; > u32 base_offset = layer->config.base_offset * layer_stride; > u32 buffer_offset = layer->config.buffer_offset * layer_stride; > - u8 buffer_sel = 0; > - u16 voffset = 0; > - u16 hoffset = 0; > + u32 buffer_sel = 0; > + u32 voffset = 0; > + u32 hoffset = 0; > phys_addr_t fb_addr; > u32 fb_offset; > u32 gap; > diff --git a/drivers/gpu/drm/logicvc/logicvc_layer.h b/drivers/gpu/drm/logicvc/logicvc_layer.h > index 4a4b02e9b819..a06feeda3abf 100644 > --- a/drivers/gpu/drm/logicvc/logicvc_layer.h > +++ b/drivers/gpu/drm/logicvc/logicvc_layer.h > @@ -18,9 +18,9 @@ > #define LOGICVC_LAYER_ALPHA_PIXEL 1 > > struct logicvc_layer_buffer_setup { > - u8 buffer_sel; > - u16 voffset; > - u16 hoffset; > + u32 buffer_sel; > + u32 voffset; > + u32 hoffset; > }; > > struct logicvc_layer_config { > -- > 2.42.0 >
diff --git a/drivers/gpu/drm/logicvc/logicvc_layer.c b/drivers/gpu/drm/logicvc/logicvc_layer.c index 464000aea765..eea22379d042 100644 --- a/drivers/gpu/drm/logicvc/logicvc_layer.c +++ b/drivers/gpu/drm/logicvc/logicvc_layer.c @@ -268,9 +268,9 @@ int logicvc_layer_buffer_find_setup(struct logicvc_drm *logicvc, u32 layer_stride = layer_bytespp * logicvc->config.row_stride; u32 base_offset = layer->config.base_offset * layer_stride; u32 buffer_offset = layer->config.buffer_offset * layer_stride; - u8 buffer_sel = 0; - u16 voffset = 0; - u16 hoffset = 0; + u32 buffer_sel = 0; + u32 voffset = 0; + u32 hoffset = 0; phys_addr_t fb_addr; u32 fb_offset; u32 gap; diff --git a/drivers/gpu/drm/logicvc/logicvc_layer.h b/drivers/gpu/drm/logicvc/logicvc_layer.h index 4a4b02e9b819..a06feeda3abf 100644 --- a/drivers/gpu/drm/logicvc/logicvc_layer.h +++ b/drivers/gpu/drm/logicvc/logicvc_layer.h @@ -18,9 +18,9 @@ #define LOGICVC_LAYER_ALPHA_PIXEL 1 struct logicvc_layer_buffer_setup { - u8 buffer_sel; - u16 voffset; - u16 hoffset; + u32 buffer_sel; + u32 voffset; + u32 hoffset; }; struct logicvc_layer_config {
The buffer_sel, voffset and hoffset values are calculated from u32 values and might overflow under certain conditions. Move them to u32 definitions instead of u8/u16 to avoid the issue. Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Fixes: efeeaefe9be5 ("drm: Add support for the LogiCVC display controller") --- drivers/gpu/drm/logicvc/logicvc_layer.c | 6 +++--- drivers/gpu/drm/logicvc/logicvc_layer.h | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-)