shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-05 02:21:52 +09:00
Code Issues Packages Projects Releases Wiki Activity

drm/mediatek: Fix coverity issue with unintentional integer overflow

Browse Source 
commit b0b0d811eac6b4c52cb9ad632fa6384cf48869e7 upstream.

1. Instead of multiplying 2 variable of different types. Change to
assign a value of one variable and then multiply the other variable.

2. Add a int variable for multiplier calculation instead of calculating
different types multiplier with dma_addr_t variable directly.

Fixes: 1a64a7aff8 ("drm/mediatek: Fix cursor plane no update")
Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com>
Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patchwork.kernel.org/project/dri-devel/patch/20230907091425.9526-1-jason-jh.lin@mediatek.com/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
[ For certain code segments with coverity issue do not exist in
  function mtk_plane_update_new_state(), those not present in v6.1 are
  not back ported. ]
Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jason-JH.Lin
2023-09-07 17:14:25 +08:00
committed by Greg Kroah-Hartman
parent 2d4a7a091f
commit a12bd67510
2 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/gpu/drm/mediatek/mtk_drm_gem.c
View File

@@ -119,7 +119,14 @@ int mtk_drm_gem_dumb_create(struct drm_file *file_priv, struct drm_device *dev,
int ret;
args->pitch = DIV_ROUND_UP(args->width * args->bpp, 8);
args->size = args->pitch * args->height;
/*
* Multiply 2 variables of different types,
* for example: args->size = args->spacing * args->height;
* may cause coverity issue with unintentional overflow.
*/
args->size = args->pitch;
args->size *= args->height;
mtk_gem = mtk_drm_gem_create(dev, args->size, false);
if (IS_ERR(mtk_gem))

13
drivers/gpu/drm/mediatek/mtk_drm_plane.c
View File

@@ -120,6 +120,7 @@ static void mtk_plane_update_new_state(struct drm_plane_state *new_state,
struct mtk_drm_gem_obj *mtk_gem;
unsigned int pitch, format;
dma_addr_t addr;
int offset;
gem = fb->obj[0];
mtk_gem = to_mtk_gem_obj(gem);
@@ -127,8 +128,16 @@ static void mtk_plane_update_new_state(struct drm_plane_state *new_state,
pitch = fb->pitches[0];
format = fb->format->format;
addr += (new_state->src.x1 >> 16) * fb->format->cpp[0];
addr += (new_state->src.y1 >> 16) * pitch;
/*
* Using dma_addr_t variable to calculate with multiplier of different types,
* for example: addr += (new_state->src.x1 >> 16) * fb->format->cpp[0];
* may cause coverity issue with unintentional overflow.
*/
offset = (new_state->src.x1 >> 16) * fb->format->cpp[0];
addr += offset;
offset = (new_state->src.y1 >> 16) * pitch;
addr += offset;
mtk_plane_state->pending.enable = true;
mtk_plane_state->pending.pitch = pitch;