[PATCH 1/8] drm/fb: More paranoia in addfb checks

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



- Our limit is uint32_t, make that explicit.

- Untangle the one overflow check, I think (but not sure) that with
  all three together you could overflow the uint64_t and it'd look
  cool again. Hence two steps. Also go with the more common (and imo
  safer approach) of reducing the range we accept, instead of trying
  to compute the overflow in high enough precision.

- The above would blow up if we get a 0 pitches, so check for that
  too, but only if block_size is a thing.

Cc: Pekka Paalanen <pekka.paalanen@xxxxxxxxxxxxxxx>
Signed-off-by: Daniel Vetter <daniel.vetter@xxxxxxxxx>
---
 drivers/gpu/drm/drm_framebuffer.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index 57564318ceea..3141c6ed6dd2 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -214,15 +214,20 @@ static int framebuffer_check(struct drm_device *dev,
 			return -EINVAL;
 		}
 
-		if (min_pitch > UINT_MAX)
+		if (min_pitch > U8_MAX)
 			return -ERANGE;
 
-		if ((uint64_t) height * r->pitches[i] + r->offsets[i] > UINT_MAX)
-			return -ERANGE;
+		if (block_size) {
+			if (r->pitches[i] < min_pitch) {
+				DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
+				return -EINVAL;
+			}
 
-		if (block_size && r->pitches[i] < min_pitch) {
-			DRM_DEBUG_KMS("bad pitch %u for plane %d\n", r->pitches[i], i);
-			return -EINVAL;
+			if (height > U8_MAX / r->pitches[i])
+				return -ERANGE;
+
+			if (r->offsets[i] > U8_MAX / r->pitches[i] - height)
+				return -ERANGE;
 		}
 
 		if (r->modifier[i] && !(r->flags & DRM_MODE_FB_MODIFIERS)) {
-- 
2.24.0

_______________________________________________
Intel-gfx mailing list
Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/intel-gfx




[Index of Archives]     [AMD Graphics]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux