diff mbox series

drm/exynos: fix potential integer overflow in exynos_drm_gem_dumb_create()

Message ID 20241018011604.24875-1-zichenxie0106@gmail.com
State New
Headers show
Series drm/exynos: fix potential integer overflow in exynos_drm_gem_dumb_create() | expand

Commit Message

Gax-c Oct. 18, 2024, 1:16 a.m. UTC 
From: Zichen Xie <zichenxie0106@gmail.com>

This was found by a static analyzer.
There may be potential integer overflow issue in
exynos_drm_gem_dumb_create(). args->size is defined
as "__u64" while args->pitch and args->height are
both defined as "__u32". The result of
"args->pitch * args->height" will be limited to
"__u32" without correct casting.
Even if the overflow is quite difficult to
happen, we still recommand adding an extra cast.

Fixes: 7da5907c84f8 ("drm/exynos: fixed page align bug.")
Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
---
 drivers/gpu/drm/exynos/exynos_drm_gem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index 638ca96830e9..de2126853d2c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -337,7 +337,7 @@  int exynos_drm_gem_dumb_create(struct drm_file *file_priv,
 	 */
 
 	args->pitch = args->width * ((args->bpp + 7) / 8);
-	args->size = args->pitch * args->height;
+	args->size = (__u64)args->pitch * args->height;
 
 	if (is_drm_iommu_supported(dev))
 		flags = EXYNOS_BO_NONCONTIG | EXYNOS_BO_WC;