From: Zichen Xie <zichenxie0106@xxxxxxxxx>
This was found by a static analyzer.
There may be potential integer overflow issue in
exynos_drm_gem_dumb_create(). args->size is defined
as "__u64" while args->pitch and args->height are
both defined as "__u32". The result of
"args->pitch * args->height" will be limited to
"__u32" without correct casting.
Even if the overflow is quite difficult to
happen, we still recommand adding an extra cast.
Fixes: 7da5907c84f8 ("drm/exynos: fixed page align bug.")
Signed-off-by: Zichen Xie <zichenxie0106@xxxxxxxxx>
---
drivers/gpu/drm/exynos/exynos_drm_gem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index 638ca96830e9..de2126853d2c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -337,7 +337,7 @@ int exynos_drm_gem_dumb_create(struct drm_file *file_priv,
*/
args->pitch = args->width * ((args->bpp + 7) / 8);
- args->size = args->pitch * args->height;
+ args->size = (__u64)args->pitch * args->height;
if (is_drm_iommu_supported(dev))
flags = EXYNOS_BO_NONCONTIG | EXYNOS_BO_WC;
--
2.34.1
