Intel-GFX Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Jani Nikula <jani.nikula@linux.intel.com>
To: Krzysztof Karas <krzysztof.karas@intel.com>,
	intel-gfx@lists.freedesktop.org
Cc: "Thomas Zimmermann" <tzimmermann@suse.de>,
	"Noralf Trønnes" <noralf@tronnes.org>,
	"Simona Vetter" <simona.vetter@ffwll.ch>,
	"Andi Shyti" <andi.shyti@linux.intel.com>,
	"Sebastian Brzezinka" <sebastian.brzezinka@intel.com>,
	"Krzysztof Niemiec" <krzysztof.niemiec@intel.com>,
	"Krzysztof Karas" <krzysztof.karas@intel.com>
Subject: Re: [PATCH 6/6] drm: Avoid undefined behavior on u16 multiplication
Date: Mon, 08 Sep 2025 14:39:34 +0300	[thread overview]
Message-ID: <4a6f41cf353a6ba2ade0af08f8eebf99c82e5cac@intel.com> (raw)
In-Reply-To: <bc353160d0c3d7f662f66edd8b33ecee2b851b67@intel.com>

On Mon, 08 Sep 2025, Jani Nikula <jani.nikula@linux.intel.com> wrote:
> On Mon, 08 Sep 2025, Krzysztof Karas <krzysztof.karas@intel.com> wrote:
>> Fields hdiplay and vdisplay are defined as u16. Their
>> multiplication causes implicit promotion to signed 32-bit value,
>> which may overflow and cause undefined behavior.
>>
>> The same goes for vpos, which is multiplied by signed integer.
>>
>> Prevent possible undefined behavior by explicitly casting one of
>> the operands to (unsigned int) type.
>>
>> Fixes: 3ed4351a83ca ("drm: Extract drm_vblank.[hc]")
>> Fixes: cc4312127108 ("drm/tinydrm/mipi-dbi: Add mipi_dbi_init_with_formats()")
>> Fixes: 80f7c3f77697 ("drm/vram: Add helpers to validate a display mode's memory requirements")
>> Cc: Thomas Zimmermann <tzimmermann@suse.de>
>> Cc: Noralf Trønnes <noralf@tronnes.org>
>> Cc: Simona Vetter <simona.vetter@ffwll.ch>
>> Cc: <stable@vger.kernel.org> # v4.13+
>> Cc: <stable@vger.kernel.org> # v5.4+
>> Cc: <stable@vger.kernel.org> # v5.7+
>
> The multitude of files, Fixes and subsequent Cc: stables with different
> target kernels is just an indication this should be three separate
> patches.
>
> The cause may be the same, but they're still unrelated fixes.
>
> Moreover, imagine the consequences of one of these fixes ending up being
> incorrect, and you have to revert or fix it. It's a logistics PITA.

Also, depending on things introduced in v5.7 means this can't be
backported to v5.4 either. Not very important here, but something to
consider for the future.

BR,
Jani.


-- 
Jani Nikula, Intel

  reply	other threads:[~2025-09-08 11:39 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-09-08  9:22 [PATCH 0/6] drm: Miscellaneous fixes in drm code Krzysztof Karas
2025-09-08  9:23 ` [PATCH 1/6] drm/i915/gem: Avoid accessing uninitialized context in emit_rpcs_query() Krzysztof Karas
2025-09-08 10:54   ` Andi Shyti
2025-09-08 11:02   ` Sebastian Brzezinka
2025-09-08  9:23 ` [PATCH 2/6] drm/i915: Add default case for the switch in igt_smoke_tiling() Krzysztof Karas
2025-09-08 11:03   ` Andi Shyti
2025-09-09  6:16     ` Krzysztof Karas
2025-09-08  9:24 ` [PATCH 3/6] drm: Remove drm_modeset_backoff() return code Krzysztof Karas
2025-09-08 11:06   ` Andi Shyti
2025-09-09  6:11     ` Krzysztof Karas
2025-09-08  9:25 ` [PATCH 4/6] drm: Avoid suspicious operations in drm_fb_dma_get_gem_addr() Krzysztof Karas
2025-09-08 11:25   ` Sebastian Brzezinka
2025-09-08  9:26 ` [PATCH 5/6] drm: Do not attempt to round_up() zeros in drm_suballoc_try_alloc() Krzysztof Karas
2025-09-08  9:27 ` [PATCH 6/6] drm: Avoid undefined behavior on u16 multiplication Krzysztof Karas
2025-09-08  9:44   ` Jani Nikula
2025-09-08 11:39     ` Jani Nikula [this message]
2025-09-09  6:07       ` Krzysztof Karas
2025-09-08  9:39 ` [PATCH 0/6] drm: Miscellaneous fixes in drm code Jani Nikula
2025-09-08 17:48 ` ✗ i915.CI.BAT: failure for " Patchwork

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4a6f41cf353a6ba2ade0af08f8eebf99c82e5cac@intel.com \
    --to=jani.nikula@linux.intel.com \
    --cc=andi.shyti@linux.intel.com \
    --cc=intel-gfx@lists.freedesktop.org \
    --cc=krzysztof.karas@intel.com \
    --cc=krzysztof.niemiec@intel.com \
    --cc=noralf@tronnes.org \
    --cc=sebastian.brzezinka@intel.com \
    --cc=simona.vetter@ffwll.ch \
    --cc=tzimmermann@suse.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox