From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E28CAE95396 for ; Wed, 4 Feb 2026 13:26:10 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 3BCBF10E023; Wed, 4 Feb 2026 13:26:10 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by gabe.freedesktop.org (Postfix) with ESMTP id 3C22210E023 for ; Wed, 4 Feb 2026 13:26:09 +0000 (UTC) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 67D68497 for ; Wed, 4 Feb 2026 05:26:02 -0800 (PST) Received: from [192.168.0.1] (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 913353F778 for ; Wed, 4 Feb 2026 05:26:08 -0800 (PST) Date: Wed, 4 Feb 2026 13:24:30 +0000 From: Liviu Dudau To: Brian Starkey Cc: Alexander Konyukhov , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org, nd@arm.com Subject: Re: [PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check Message-ID: References: <20260203134907.1587067-1-Alexander.Konyukhov@kaspersky.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Tue, Feb 03, 2026 at 09:43:12PM +0000, Brian Starkey wrote: > Hi Alexander, > > On Tue, Feb 03, 2026 at 04:48:46PM +0000, Alexander Konyukhov wrote: > > The AFBC framebuffer size validation calculates the minimum required > > buffer size by adding the AFBC payload size to the framebuffer offset. > > This addition is performed without checking for integer overflow. > > > > If the addition oveflows, the size check may incorrectly succed and > > allow userspace to provide an undersized drm_gem_object, potentially > > leading to out-of-bounds memory access. > > > > Add usage of check_add_overflow() to safely compute the minimum > > required size and reject the framebuffer if an overflow is detected. > > This makes the AFBC size validation more robust against malformed. > > > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > > > Fixes: 65ad2392dd6d ("drm/komeda: Added AFBC support for komeda driver") > > Signed-off-by: Alexander Konyukhov > > --- > > drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c | 6 +++++- > > 1 file changed, 5 insertions(+), 1 deletion(-) > > > > diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c > > index 3ca461eb0a24..3cb34d03f7f8 100644 > > --- a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c > > +++ b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c > > @@ -4,6 +4,8 @@ > > * Author: James.Qian.Wang > > * > > */ > > +#include > > + > > #include > > #include > > #include > > @@ -93,7 +95,9 @@ komeda_fb_afbc_size_check(struct komeda_fb *kfb, struct drm_file *file, > > kfb->afbc_size = kfb->offset_payload + n_blocks * > > ALIGN(bpp * AFBC_SUPERBLK_PIXELS / 8, > > AFBC_SUPERBLK_ALIGNMENT); > > - min_size = kfb->afbc_size + fb->offsets[0]; > > Can this really overflow? Is the concern a hypothetical ILP64 > situation? > > min_size is u64, kfb->afbc_size is u32, and fb->offsets[0] is unsigned > int. Yeah, I was thinking the same thing yesterday at the end of the work day when I looked at the patch. I don't think following the call flow you can end up with an overflow. Best regards, Liviu > > Thanks, > -Brian > > > + if (check_add_overflow(kfb->afbc_size, fb->offsets[0], &min_size)) { > > + goto check_failed; > > + } > > if (min_size > obj->size) { > > DRM_DEBUG_KMS("afbc size check failed, obj_size: 0x%zx. min_size 0x%llx.\n", > > obj->size, min_size); > > -- > > 2.43.0 > >