[PATCH] drm/sitronix: st7571: fix hwbuf heap buffer overflow from unaligned nlines

[PATCH] drm/sitronix: st7571: fix hwbuf heap buffer overflow from unaligned nlines

[Hui Peng]

In st7571_fb_blit_rect() (drivers/gpu/drm/sitronix/st7571.c), align y1
down and y2 up to multiples of 8 rows before computing nlines so the
byte count written into st7571->hwbuf matches the allocated page-aligned
buffer capacity and cannot overflow st7571->hwbuf.

Fixes: b362de167daf ("drm/sitronix/st7571: split up the driver into a common and an i2c part")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/drivers/gpu/drm/sitronix/st7571.c b/drivers/gpu/drm/sitronix/st7571.c
index 20954c33eca9..e1e95b360255 100644
--- a/drivers/gpu/drm/sitronix/st7571.c
+++ b/drivers/gpu/drm/sitronix/st7571.c
@@ -827,7 +827,8 @@ struct st7571_device *st7571_probe(struct device *dev,
 	st7571->regmap = regmap;
 
 	st7571->hwbuf = devm_kzalloc(st7571->dev,
-				     (st7571->nlines * st7571->ncols * st7571->bpp) / 8,
+				     (round_up(st7571->nlines, 8) *
+				      st7571->ncols * st7571->bpp) / 8,
 				     GFP_KERNEL);
 	if (!st7571->hwbuf)
 		return ERR_PTR(-ENOMEM);

Re: [PATCH] drm/sitronix: st7571: fix hwbuf heap buffer overflow from unaligned nlines

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] drm/sitronix: commit message and patch implementation completely mismatched
--

commit 46fb9fd81496f4b52e8d10740054c55dda3862dc
Author: Hui Peng <benquike@gmail.com>

drm/sitronix: st7571: fix hwbuf heap buffer overflow from unaligned nlines

The commit attempts to fix a heap buffer overflow in the sitronix st7571 driver
by ensuring the allocated buffer size is aligned.

> In st7571_fb_blit_rect() (drivers/gpu/drm/sitronix/st7571.c), align y1
> down and y2 up to multiples of 8 rows before computing nlines so the
> byte count written into st7571->hwbuf matches the allocated page-aligned
> buffer capacity and cannot overflow st7571->hwbuf.

[Severity: Medium]
Does the commit message describe the actual changes made in this patch?

The message claims to fix an issue in st7571_fb_blit_rect() by modifying how
coordinates y1 and y2 are aligned. However, the patch does not modify this
function, but instead rounds up an allocation size in st7571_probe().

> diff --git a/drivers/gpu/drm/sitronix/st7571.c b/drivers/gpu/drm/sitronix/st7571.c
> index fc3ba5e8600f6..40017ee5a1f6e 100644
> --- a/drivers/gpu/drm/sitronix/st7571.c
> +++ b/drivers/gpu/drm/sitronix/st7571.c
> @@ -827,7 +827,8 @@ struct st7571_device *st7571_probe(struct device *dev,
>  	st7571->regmap = regmap;
>  
>  	st7571->hwbuf = devm_kzalloc(st7571->dev,
> -				     (st7571->nlines * st7571->ncols * st7571->bpp) / 8,
> +				     (round_up(st7571->nlines, 8) *
> +				      st7571->ncols * st7571->bpp) / 8,
>  				     GFP_KERNEL);

Could the commit message be updated to match the implementation?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919222631.3798442-1-benquike@gmail.com?part=1