drm/sysfb: simpledrm: Improve stride validation

Validate the computed stride against the maximum value INT_MAX.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Thierry Reding <treding@nvidia.com>
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Fixes: 7bfa5c7b28 ("drm/simpledrm: Compute linestride with drm_format_info_min_pitch()")
Cc: <stable@vger.kernel.org> # v6.1+
Link: https://patch.msgid.link/20260625094509.157581-5-tzimmermann@suse.de
This commit is contained in:
Thomas Zimmermann 2026-06-25 11:39:36 +02:00
parent 61ab4a942a
commit df6533f116

View File

@ -703,9 +703,15 @@ static struct simpledrm_device *simpledrm_device_create(struct drm_driver *drv,
return ERR_PTR(-ENODEV);
}
if (!stride) {
stride = drm_format_info_min_pitch(format, 0, width);
if (drm_WARN_ON(dev, !stride))
u64 pitch = drm_format_info_min_pitch(format, 0, width);
if (drm_WARN_ON(dev, !pitch)) {
return ERR_PTR(-EINVAL); /* driver bug */
} else if (pitch > INT_MAX) {
drm_warn(dev, "stride of %llu exceeds maximum\n", pitch);
return ERR_PTR(-EINVAL);
}
stride = pitch;
}
sysfb->fb_mode = drm_sysfb_mode(width, height, width_mm, height_mm);