The buffer_sel, voffset and hoffset values are calculated from u32 values and might overflow under certain conditions. Move them to u32 definitions instead of u8/u16 to avoid the issue. Signed-off-by: Paul Kocialkowski <paul.kocialkowski@xxxxxxxxxxx> Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Fixes: efeeaefe9be5 ("drm: Add support for the LogiCVC display controller") --- drivers/gpu/drm/logicvc/logicvc_layer.c | 6 +++--- drivers/gpu/drm/logicvc/logicvc_layer.h | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/logicvc/logicvc_layer.c b/drivers/gpu/drm/logicvc/logicvc_layer.c index 464000aea765..eea22379d042 100644 --- a/drivers/gpu/drm/logicvc/logicvc_layer.c +++ b/drivers/gpu/drm/logicvc/logicvc_layer.c @@ -268,9 +268,9 @@ int logicvc_layer_buffer_find_setup(struct logicvc_drm *logicvc, u32 layer_stride = layer_bytespp * logicvc->config.row_stride; u32 base_offset = layer->config.base_offset * layer_stride; u32 buffer_offset = layer->config.buffer_offset * layer_stride; - u8 buffer_sel = 0; - u16 voffset = 0; - u16 hoffset = 0; + u32 buffer_sel = 0; + u32 voffset = 0; + u32 hoffset = 0; phys_addr_t fb_addr; u32 fb_offset; u32 gap; diff --git a/drivers/gpu/drm/logicvc/logicvc_layer.h b/drivers/gpu/drm/logicvc/logicvc_layer.h index 4a4b02e9b819..a06feeda3abf 100644 --- a/drivers/gpu/drm/logicvc/logicvc_layer.h +++ b/drivers/gpu/drm/logicvc/logicvc_layer.h @@ -18,9 +18,9 @@ #define LOGICVC_LAYER_ALPHA_PIXEL 1 struct logicvc_layer_buffer_setup { - u8 buffer_sel; - u16 voffset; - u16 hoffset; + u32 buffer_sel; + u32 voffset; + u32 hoffset; }; struct logicvc_layer_config { -- 2.42.0