This is a note to let you know that I've just added the patch titled drm/sun4i: Fix an ulong overflow in the dotclock driver to the 4.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: drm-sun4i-fix-an-ulong-overflow-in-the-dotclock-driver.patch and it can be found in the queue-4.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From e84cb605e02f1b3d0aee8d7157419cd8aaa06038 Mon Sep 17 00:00:00 2001 From: Boris Brezillon <boris.brezillon@xxxxxxxxxxx> Date: Thu, 18 Oct 2018 12:02:50 +0200 Subject: drm/sun4i: Fix an ulong overflow in the dotclock driver From: Boris Brezillon <boris.brezillon@xxxxxxxxxxx> commit e84cb605e02f1b3d0aee8d7157419cd8aaa06038 upstream. The calculated ideal rate can easily overflow an unsigned long, thus making the best div selection buggy as soon as no ideal match is found before the overflow occurs. Fixes: 4731a72df273 ("drm/sun4i: request exact rates to our parents") Cc: <stable@xxxxxxxxxxxxxxx> Signed-off-by: Boris Brezillon <boris.brezillon@xxxxxxxxxxx> Acked-by: Maxime Ripard <maxime.ripard@xxxxxxxxxxx> Signed-off-by: Maxime Ripard <maxime.ripard@xxxxxxxxxxx> Link: https://patchwork.freedesktop.org/patch/msgid/20181018100250.12565-1-boris.brezillon@xxxxxxxxxxx Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/gpu/drm/sun4i/sun4i_dotclock.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/sun4i/sun4i_dotclock.c +++ b/drivers/gpu/drm/sun4i/sun4i_dotclock.c @@ -81,9 +81,19 @@ static long sun4i_dclk_round_rate(struct int i; for (i = tcon->dclk_min_div; i <= tcon->dclk_max_div; i++) { - unsigned long ideal = rate * i; + u64 ideal = (u64)rate * i; unsigned long rounded; + /* + * ideal has overflowed the max value that can be stored in an + * unsigned long, and every clk operation we might do on a + * truncated u64 value will give us incorrect results. + * Let's just stop there since bigger dividers will result in + * the same overflow issue. + */ + if (ideal > ULONG_MAX) + goto out; + rounded = clk_hw_round_rate(clk_hw_get_parent(hw), ideal); Patches currently in stable-queue which might be from boris.brezillon@xxxxxxxxxxx are queue-4.18/drm-sun4i-fix-an-ulong-overflow-in-the-dotclock-driver.patch