Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Critical] Heap buffer overflow in MIPI DBI transmit buffer due to fractional source coordinates. --
commit 4a10bf379a1886aa47defe01dc700836d3b28773 Author: Jonathan Frazin <[email protected]> drm/tiny: allow a framebuffer larger than the panel on MIPI DBI drivers This commit raises the max_width and max_height for several MIPI DBI drivers to DRM_SHADOW_PLANE_MAX_WIDTH/HEIGHT. This allows userspace to allocate larger framebuffers and use the plane source rectangle to pan without scaling. > diff --git a/drivers/gpu/drm/tiny/panel-mipi-dbi.c > b/drivers/gpu/drm/tiny/panel-mipi-dbi.c > index 60cd65cae41d8..a0a098b0da8a3 100644 > --- a/drivers/gpu/drm/tiny/panel-mipi-dbi.c > +++ b/drivers/gpu/drm/tiny/panel-mipi-dbi.c [ ... ] > @@ -448,9 +448,13 @@ static int panel_mipi_dbi_spi_probe(struct spi_device > *spi) > return ret; > > drm->mode_config.min_width = dbidev->mode.hdisplay; > - drm->mode_config.max_width = dbidev->mode.hdisplay; > + /* > + * Allow a framebuffer larger than the panel so a sub-region can be > + * displayed via the plane source rectangle (crop / pan, no scaling). > + */ > + drm->mode_config.max_width = DRM_SHADOW_PLANE_MAX_WIDTH; [Severity: Critical] Can this change cause a heap buffer overflow in mipi_dbi_fb_dirty()? By allowing the framebuffer to be larger than the panel, userspace can now use non-zero source offsets. If userspace provides fractional source coordinates via the atomic ioctl, the damage iterator will round the coordinates outwards (floor and ceil). This can result in a merged damage rectangle that is larger than the physical panel dimensions, which gets passed to drm_mipi_dbi_plane_helper_atomic_update(): drivers/gpu/drm/drm_mipi_dbi.c:drm_mipi_dbi_plane_helper_atomic_update() { ... if (drm_atomic_helper_damage_merged(old_plane_state, plane_state, &rect)) mipi_dbi_fb_dirty(&shadow_plane_state->data[0], fb, &rect, ... } Then in mipi_dbi_fb_dirty(), the inflated rectangle is used to compute the copy bounds: drivers/gpu/drm/drm_mipi_dbi.c:mipi_dbi_fb_dirty() { ... unsigned int height = rect->y2 - rect->y1; unsigned int width = rect->x2 - rect->x1; ... ret = mipi_dbi_buf_copy(tr, src, fb, rect, swap, fmtcnv_state); ... } Since tx_buf was strictly allocated during drm_mipi_dbi_dev_init() to hold exactly the panel size, copying based on this inflated width and height will overflow tx_buf on the heap. > drm->mode_config.min_height = dbidev->mode.vdisplay; > - drm->mode_config.max_height = dbidev->mode.vdisplay; > + drm->mode_config.max_height = DRM_SHADOW_PLANE_MAX_HEIGHT; > drm->mode_config.funcs = &panel_mipi_dbi_mode_config_funcs; > drm->mode_config.preferred_depth = bpp; > drm->mode_config.helper_private = > &panel_mipi_dbi_mode_config_helper_funcs; -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=2
