Thomas Zimmermann <[email protected]> writes: > Passing a maximum as 64-bit type to drm_sysfb_get_validated_int0() > can truncate the value to 32 bits. Use drm_sysfb_get_validated_size0(), > which uses 64-bit arithmetics. Then test the returned stride against > the limits of int to avoid truncations in the returned value. A valid > stride is in the range of [1, INT_MAX] inclusive. > > Signed-off-by: Thomas Zimmermann <[email protected]> > Reported-by: Sashiko <[email protected]> > Closes: > https://lore.kernel.org/dri-devel/[email protected]/ > Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays") > Fixes: a84eb6abe2b6 ("drm/sysfb: Add vesadrm for VESA displays") > Cc: Thomas Zimmermann <[email protected]> > Cc: Javier Martinez Canillas <[email protected]> > Cc: [email protected] > Cc: <[email protected]> # v6.16+ > --- > I've added Reported-by and Closes tags because this is a pre-existing issue. > --- > drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) >
Reviewed-by: Javier Martinez Canillas <[email protected]> -- Best regards, Javier Martinez Canillas Core Platforms Red Hat
