Validate the computed stride against the maximum value INT_MAX.
Signed-off-by: Thomas Zimmermann <[email protected]>
Fixes: 7bfa5c7b28d6 ("drm/simpledrm: Compute linestride with
drm_format_info_min_pitch()")
Cc: <[email protected]> # v6.1+
---
drivers/gpu/drm/sysfb/simpledrm.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/sysfb/simpledrm.c
b/drivers/gpu/drm/sysfb/simpledrm.c
index 709922ea656c..76b9a3f5c4ef 100644
--- a/drivers/gpu/drm/sysfb/simpledrm.c
+++ b/drivers/gpu/drm/sysfb/simpledrm.c
@@ -694,9 +694,15 @@ static struct simpledrm_device
*simpledrm_device_create(struct drm_driver *drv,
return ERR_PTR(-ENODEV);
}
if (!stride) {
- stride = drm_format_info_min_pitch(format, 0, width);
- if (drm_WARN_ON(dev, !stride))
+ u64 pitch = drm_format_info_min_pitch(format, 0, width);
+
+ if (drm_WARN_ON(dev, !pitch)) {
+ return ERR_PTR(-EINVAL); /* driver bug */
+ } else if (pitch > INT_MAX) {
+ drm_warn(dev, "stride of %llu exceeds maximum\n",
pitch);
return ERR_PTR(-EINVAL);
+ }
+ stride = pitch;
}
sysfb->fb_mode = drm_sysfb_mode(width, height, width_mm, height_mm);
--
2.54.0
