Re: [PATCH v1 2/2] drm/tiny: allow a framebuffer larger than the panel on MIPI DBI drivers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Heap buffer overflow in MIPI DBI transmit buffer due to fractional source coordinates.
--

commit 4a10bf379a1886aa47defe01dc700836d3b28773
Author: Jonathan Frazin <frazinjonathan@gmail.com>

drm/tiny: allow a framebuffer larger than the panel on MIPI DBI drivers

This commit raises the max_width and max_height for several MIPI DBI
drivers to DRM_SHADOW_PLANE_MAX_WIDTH/HEIGHT. This allows userspace to
allocate larger framebuffers and use the plane source rectangle to
pan without scaling.

> diff --git a/drivers/gpu/drm/tiny/panel-mipi-dbi.c b/drivers/gpu/drm/tiny/panel-mipi-dbi.c
> index 60cd65cae41d8..a0a098b0da8a3 100644
> --- a/drivers/gpu/drm/tiny/panel-mipi-dbi.c
> +++ b/drivers/gpu/drm/tiny/panel-mipi-dbi.c
[ ... ]
> @@ -448,9 +448,13 @@ static int panel_mipi_dbi_spi_probe(struct spi_device *spi)
>  		return ret;
>  
>  	drm->mode_config.min_width = dbidev->mode.hdisplay;
> -	drm->mode_config.max_width = dbidev->mode.hdisplay;
> +	/*
> +	 * Allow a framebuffer larger than the panel so a sub-region can be
> +	 * displayed via the plane source rectangle (crop / pan, no scaling).
> +	 */
> +	drm->mode_config.max_width = DRM_SHADOW_PLANE_MAX_WIDTH;

[Severity: Critical]
Can this change cause a heap buffer overflow in mipi_dbi_fb_dirty()?

By allowing the framebuffer to be larger than the panel, userspace can now
use non-zero source offsets. If userspace provides fractional source
coordinates via the atomic ioctl, the damage iterator will round the
coordinates outwards (floor and ceil).

This can result in a merged damage rectangle that is larger than the
physical panel dimensions, which gets passed to
drm_mipi_dbi_plane_helper_atomic_update():

drivers/gpu/drm/drm_mipi_dbi.c:drm_mipi_dbi_plane_helper_atomic_update() {
    ...
    if (drm_atomic_helper_damage_merged(old_plane_state, plane_state, &rect))
        mipi_dbi_fb_dirty(&shadow_plane_state->data[0], fb, &rect,
    ...
}

Then in mipi_dbi_fb_dirty(), the inflated rectangle is used to compute the
copy bounds:

drivers/gpu/drm/drm_mipi_dbi.c:mipi_dbi_fb_dirty() {
    ...
    unsigned int height = rect->y2 - rect->y1;
    unsigned int width = rect->x2 - rect->x1;
    ...
    ret = mipi_dbi_buf_copy(tr, src, fb, rect, swap, fmtcnv_state);
    ...
}

Since tx_buf was strictly allocated during drm_mipi_dbi_dev_init() to hold
exactly the panel size, copying based on this inflated width and height will
overflow tx_buf on the heap.

>  	drm->mode_config.min_height = dbidev->mode.vdisplay;
> -	drm->mode_config.max_height = dbidev->mode.vdisplay;
> +	drm->mode_config.max_height = DRM_SHADOW_PLANE_MAX_HEIGHT;
>  	drm->mode_config.funcs = &panel_mipi_dbi_mode_config_funcs;
>  	drm->mode_config.preferred_depth = bpp;
>  	drm->mode_config.helper_private = &panel_mipi_dbi_mode_config_helper_funcs;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910185030.870-1-frazinjonathan@gmail.com?part=2