Increase the limits for dumb-buffer arguments to sizes of 16384x16384 at 64 bpp. Such buffer sizes are still within 32-bit unsigned limits. Fixes CI and high-end devices.
Signed-off-by: Thomas Zimmermann <[email protected]> Fixes: 5ab62dd3687b ("drm: prevent integer overflows in dumb buffer creation helpers") Reported-by: Jani Nikula <[email protected]> Closes: https://lore.kernel.org/dri-devel/[email protected]/ Cc: Rajat Gupta <[email protected]> Cc: Thomas Zimmermann <[email protected]> Cc: Maarten Lankhorst <[email protected]> Cc: Maxime Ripard <[email protected]> --- drivers/gpu/drm/drm_dumb_buffers.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_dumb_buffers.c b/drivers/gpu/drm/drm_dumb_buffers.c index e60130b2bb0c..9c4cfb3210aa 100644 --- a/drivers/gpu/drm/drm_dumb_buffers.c +++ b/drivers/gpu/drm/drm_dumb_buffers.c @@ -201,11 +201,12 @@ int drm_mode_create_dumb(struct drm_device *dev, if (!args->width || !args->height || !args->bpp) return -EINVAL; - /* Reject unreasonable inputs early. Dumb buffers are for software - * rendering; nothing legitimate needs more than 8192x8192 at 32bpp. - * This prevents overflows in downstream alignment helpers. + /* + * Reject unreasonable inputs early. Dumb buffers are for software + * rendering; nothing legitimate needs more than 16384x16384 at + * 64 bpp. This prevents overflows in downstream alignment helpers. */ - if (args->width >= 8192 || args->height >= 8192 || args->bpp > 32) + if (args->width > 16384 || args->height > 16384 || args->bpp > 64) return -EINVAL; /* overflow checks for 32bit size calculations */ base-commit: a980196655477a8f5067112946401fe52e510664 -- 2.54.0
