[PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check

[PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check

[Alexander Konyukhov]

The AFBC framebuffer size validation calculates the minimum required
buffer size by adding the AFBC payload size to the framebuffer offset.
This addition is performed without checking for integer overflow.

If the addition oveflows, the size check may incorrectly succed and
allow userspace to provide an undersized drm_gem_object, potentially
leading to out-of-bounds memory access.

Add usage of check_add_overflow() to safely compute the minimum
required size and reject the framebuffer if an overflow is detected.
This makes the AFBC size validation more robust against malformed.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 65ad2392dd6d ("drm/komeda: Added AFBC support for komeda driver")
Signed-off-by: Alexander Konyukhov <Alexander.Konyukhov@kaspersky.com>
---
 drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
index 3ca461eb0a24..3cb34d03f7f8 100644
--- a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
+++ b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
@@ -4,6 +4,8 @@
  * Author: James.Qian.Wang <james.qian.wang@arm.com>
  *
  */
+#include <linux/overflow.h>
+
 #include <drm/drm_device.h>
 #include <drm/drm_fb_dma_helper.h>
 #include <drm/drm_gem.h>
@@ -93,7 +95,9 @@ komeda_fb_afbc_size_check(struct komeda_fb *kfb, struct drm_file *file,
 	kfb->afbc_size = kfb->offset_payload + n_blocks *
 			 ALIGN(bpp * AFBC_SUPERBLK_PIXELS / 8,
 			       AFBC_SUPERBLK_ALIGNMENT);
-	min_size = kfb->afbc_size + fb->offsets[0];
+	if (check_add_overflow(kfb->afbc_size, fb->offsets[0], &min_size)) {
+		goto check_failed;
+	}
 	if (min_size > obj->size) {
 		DRM_DEBUG_KMS("afbc size check failed, obj_size: 0x%zx. min_size 0x%llx.\n",
 			      obj->size, min_size);
-- 
2.43.0

Re: [PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check

[Brian Starkey]

Hi Alexander,

On Tue, Feb 03, 2026 at 04:48:46PM +0000, Alexander Konyukhov wrote:
> The AFBC framebuffer size validation calculates the minimum required
> buffer size by adding the AFBC payload size to the framebuffer offset.
> This addition is performed without checking for integer overflow.
> 
> If the addition oveflows, the size check may incorrectly succed and
> allow userspace to provide an undersized drm_gem_object, potentially
> leading to out-of-bounds memory access.
> 
> Add usage of check_add_overflow() to safely compute the minimum
> required size and reject the framebuffer if an overflow is detected.
> This makes the AFBC size validation more robust against malformed.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 65ad2392dd6d ("drm/komeda: Added AFBC support for komeda driver")
> Signed-off-by: Alexander Konyukhov <Alexander.Konyukhov@kaspersky.com>
> ---
>  drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> index 3ca461eb0a24..3cb34d03f7f8 100644
> --- a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> +++ b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> @@ -4,6 +4,8 @@
>   * Author: James.Qian.Wang <james.qian.wang@arm.com>
>   *
>   */
> +#include <linux/overflow.h>
> +
>  #include <drm/drm_device.h>
>  #include <drm/drm_fb_dma_helper.h>
>  #include <drm/drm_gem.h>
> @@ -93,7 +95,9 @@ komeda_fb_afbc_size_check(struct komeda_fb *kfb, struct drm_file *file,
>  	kfb->afbc_size = kfb->offset_payload + n_blocks *
>  			 ALIGN(bpp * AFBC_SUPERBLK_PIXELS / 8,
>  			       AFBC_SUPERBLK_ALIGNMENT);
> -	min_size = kfb->afbc_size + fb->offsets[0];

Can this really overflow? Is the concern a hypothetical ILP64
situation?

min_size is u64, kfb->afbc_size is u32, and fb->offsets[0] is unsigned
int.

Thanks,
-Brian

> +	if (check_add_overflow(kfb->afbc_size, fb->offsets[0], &min_size)) {
> +		goto check_failed;
> +	}
>  	if (min_size > obj->size) {
>  		DRM_DEBUG_KMS("afbc size check failed, obj_size: 0x%zx. min_size 0x%llx.\n",
>  			      obj->size, min_size);
> -- 
> 2.43.0
> 

Re: [PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check

[Liviu Dudau]

On Tue, Feb 03, 2026 at 09:43:12PM +0000, Brian Starkey wrote:
> Hi Alexander,
> 
> On Tue, Feb 03, 2026 at 04:48:46PM +0000, Alexander Konyukhov wrote:
> > The AFBC framebuffer size validation calculates the minimum required
> > buffer size by adding the AFBC payload size to the framebuffer offset.
> > This addition is performed without checking for integer overflow.
> > 
> > If the addition oveflows, the size check may incorrectly succed and
> > allow userspace to provide an undersized drm_gem_object, potentially
> > leading to out-of-bounds memory access.
> > 
> > Add usage of check_add_overflow() to safely compute the minimum
> > required size and reject the framebuffer if an overflow is detected.
> > This makes the AFBC size validation more robust against malformed.
> > 
> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> > 
> > Fixes: 65ad2392dd6d ("drm/komeda: Added AFBC support for komeda driver")
> > Signed-off-by: Alexander Konyukhov <Alexander.Konyukhov@kaspersky.com>
> > ---
> >  drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c | 6 +++++-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> > index 3ca461eb0a24..3cb34d03f7f8 100644
> > --- a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> > +++ b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> > @@ -4,6 +4,8 @@
> >   * Author: James.Qian.Wang <james.qian.wang@arm.com>
> >   *
> >   */
> > +#include <linux/overflow.h>
> > +
> >  #include <drm/drm_device.h>
> >  #include <drm/drm_fb_dma_helper.h>
> >  #include <drm/drm_gem.h>
> > @@ -93,7 +95,9 @@ komeda_fb_afbc_size_check(struct komeda_fb *kfb, struct drm_file *file,
> >  	kfb->afbc_size = kfb->offset_payload + n_blocks *
> >  			 ALIGN(bpp * AFBC_SUPERBLK_PIXELS / 8,
> >  			       AFBC_SUPERBLK_ALIGNMENT);
> > -	min_size = kfb->afbc_size + fb->offsets[0];
> 
> Can this really overflow? Is the concern a hypothetical ILP64
> situation?
> 
> min_size is u64, kfb->afbc_size is u32, and fb->offsets[0] is unsigned
> int.

Yeah, I was thinking the same thing yesterday at the end of the work day when I looked
at the patch. I don't think following the call flow you can end up with an overflow.

Best regards,
Liviu

> 
> Thanks,
> -Brian
> 
> > +	if (check_add_overflow(kfb->afbc_size, fb->offsets[0], &min_size)) {
> > +		goto check_failed;
> > +	}
> >  	if (min_size > obj->size) {
> >  		DRM_DEBUG_KMS("afbc size check failed, obj_size: 0x%zx. min_size 0x%llx.\n",
> >  			      obj->size, min_size);
> > -- 
> > 2.43.0
> > 

RE: [PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check

[Alexander Konyukhov]

Thank you for the replies.

According to ISO 9899 6.3.1 both operands are first converted to a common type (u32), there are no defined limits of kfb->afbc_size and fb->offsets[0] , so min_size can have an overflowed u32 value.

-----Original Message-----
From: Liviu Dudau <liviu.dudau@arm.com> 
Sent: Wednesday, February 4, 2026 4:25 PM
To: Brian Starkey <brian.starkey@arm.com>
Cc: Alexander Konyukhov <Alexander.Konyukhov@kaspersky.com>; Maarten Lankhorst <maarten.lankhorst@linux.intel.com>; Maxime Ripard <mripard@kernel.org>; Thomas Zimmermann <tzimmermann@suse.de>; David Airlie <airlied@gmail.com>; Simona Vetter <simona@ffwll.ch>; dri-devel@lists.freedesktop.org; linux-kernel@vger.kernel.org; lvc-project@linuxtesting.org; nd@arm.com
Subject: Re: [PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check

Caution: This is an external email.



On Tue, Feb 03, 2026 at 09:43:12PM +0000, Brian Starkey wrote:
> Hi Alexander,
>
> On Tue, Feb 03, 2026 at 04:48:46PM +0000, Alexander Konyukhov wrote:
> > The AFBC framebuffer size validation calculates the minimum required 
> > buffer size by adding the AFBC payload size to the framebuffer offset.
> > This addition is performed without checking for integer overflow.
> >
> > If the addition oveflows, the size check may incorrectly succed and 
> > allow userspace to provide an undersized drm_gem_object, potentially 
> > leading to out-of-bounds memory access.
> >
> > Add usage of check_add_overflow() to safely compute the minimum 
> > required size and reject the framebuffer if an overflow is detected.
> > This makes the AFBC size validation more robust against malformed.
> >
> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> >
> > Fixes: 65ad2392dd6d ("drm/komeda: Added AFBC support for komeda 
> > driver")
> > Signed-off-by: Alexander Konyukhov 
> > <Alexander.Konyukhov@kaspersky.com>
> > ---
> >  drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c | 6 +++++-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c 
> > b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> > index 3ca461eb0a24..3cb34d03f7f8 100644
> > --- a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> > +++ b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> > @@ -4,6 +4,8 @@
> >   * Author: James.Qian.Wang <james.qian.wang@arm.com>
> >   *
> >   */
> > +#include <linux/overflow.h>
> > +
> >  #include <drm/drm_device.h>
> >  #include <drm/drm_fb_dma_helper.h>
> >  #include <drm/drm_gem.h>
> > @@ -93,7 +95,9 @@ komeda_fb_afbc_size_check(struct komeda_fb *kfb, struct drm_file *file,
> >     kfb->afbc_size = kfb->offset_payload + n_blocks *
> >                      ALIGN(bpp * AFBC_SUPERBLK_PIXELS / 8,
> >                            AFBC_SUPERBLK_ALIGNMENT);
> > -   min_size = kfb->afbc_size + fb->offsets[0];
>
> Can this really overflow? Is the concern a hypothetical ILP64 
> situation?
>
> min_size is u64, kfb->afbc_size is u32, and fb->offsets[0] is unsigned 
> int.

Yeah, I was thinking the same thing yesterday at the end of the work day when I looked at the patch. I don't think following the call flow you can end up with an overflow.

Best regards,
Liviu

>
> Thanks,
> -Brian
>
> > +   if (check_add_overflow(kfb->afbc_size, fb->offsets[0], &min_size)) {
> > +           goto check_failed;
> > +   }
> >     if (min_size > obj->size) {
> >             DRM_DEBUG_KMS("afbc size check failed, obj_size: 0x%zx. min_size 0x%llx.\n",
> >                           obj->size, min_size);
> > --
> > 2.43.0
> >

Re: [PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check

[Liviu Dudau]

On Wed, Feb 04, 2026 at 02:56:38PM +0000, Alexander Konyukhov wrote:
> Thank you for the replies.
> 
> According to ISO 9899 6.3.1 both operands are first converted to a common type (u32), there are no defined limits of kfb->afbc_size and fb->offsets[0] , so min_size can have an overflowed u32 value.

Yes, but according to the komeda_framebuffer.c file, line 48, the min_size is an u64 variable, so it can hold the result of adding two u32 values safely.

Best regards,
Liviu

> 
> -----Original Message-----
> From: Liviu Dudau <liviu.dudau@arm.com> 
> Sent: Wednesday, February 4, 2026 4:25 PM
> To: Brian Starkey <brian.starkey@arm.com>
> Cc: Alexander Konyukhov <Alexander.Konyukhov@kaspersky.com>; Maarten Lankhorst <maarten.lankhorst@linux.intel.com>; Maxime Ripard <mripard@kernel.org>; Thomas Zimmermann <tzimmermann@suse.de>; David Airlie <airlied@gmail.com>; Simona Vetter <simona@ffwll.ch>; dri-devel@lists.freedesktop.org; linux-kernel@vger.kernel.org; lvc-project@linuxtesting.org; nd@arm.com
> Subject: Re: [PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check
> 
> Caution: This is an external email.
> 
> 
> 
> On Tue, Feb 03, 2026 at 09:43:12PM +0000, Brian Starkey wrote:
> > Hi Alexander,
> >
> > On Tue, Feb 03, 2026 at 04:48:46PM +0000, Alexander Konyukhov wrote:
> > > The AFBC framebuffer size validation calculates the minimum required 
> > > buffer size by adding the AFBC payload size to the framebuffer offset.
> > > This addition is performed without checking for integer overflow.
> > >
> > > If the addition oveflows, the size check may incorrectly succed and 
> > > allow userspace to provide an undersized drm_gem_object, potentially 
> > > leading to out-of-bounds memory access.
> > >
> > > Add usage of check_add_overflow() to safely compute the minimum 
> > > required size and reject the framebuffer if an overflow is detected.
> > > This makes the AFBC size validation more robust against malformed.
> > >
> > > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> > >
> > > Fixes: 65ad2392dd6d ("drm/komeda: Added AFBC support for komeda 
> > > driver")
> > > Signed-off-by: Alexander Konyukhov 
> > > <Alexander.Konyukhov@kaspersky.com>
> > > ---
> > >  drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c | 6 +++++-
> > >  1 file changed, 5 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c 
> > > b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> > > index 3ca461eb0a24..3cb34d03f7f8 100644
> > > --- a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> > > +++ b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> > > @@ -4,6 +4,8 @@
> > >   * Author: James.Qian.Wang <james.qian.wang@arm.com>
> > >   *
> > >   */
> > > +#include <linux/overflow.h>
> > > +
> > >  #include <drm/drm_device.h>
> > >  #include <drm/drm_fb_dma_helper.h>
> > >  #include <drm/drm_gem.h>
> > > @@ -93,7 +95,9 @@ komeda_fb_afbc_size_check(struct komeda_fb *kfb, struct drm_file *file,
> > >     kfb->afbc_size = kfb->offset_payload + n_blocks *
> > >                      ALIGN(bpp * AFBC_SUPERBLK_PIXELS / 8,
> > >                            AFBC_SUPERBLK_ALIGNMENT);
> > > -   min_size = kfb->afbc_size + fb->offsets[0];
> >
> > Can this really overflow? Is the concern a hypothetical ILP64 
> > situation?
> >
> > min_size is u64, kfb->afbc_size is u32, and fb->offsets[0] is unsigned 
> > int.
> 
> Yeah, I was thinking the same thing yesterday at the end of the work day when I looked at the patch. I don't think following the call flow you can end up with an overflow.
> 
> Best regards,
> Liviu
> 
> >
> > Thanks,
> > -Brian
> >
> > > +   if (check_add_overflow(kfb->afbc_size, fb->offsets[0], &min_size)) {
> > > +           goto check_failed;
> > > +   }
> > >     if (min_size > obj->size) {
> > >             DRM_DEBUG_KMS("afbc size check failed, obj_size: 0x%zx. min_size 0x%llx.\n",
> > >                           obj->size, min_size);
> > > --
> > > 2.43.0
> > >

Re: [PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check

[Brian Starkey]

On Wed, Feb 04, 2026 at 02:56:38PM +0000, Alexander Konyukhov wrote:
> Thank you for the replies.
> 
> According to ISO 9899 6.3.1 both operands are first converted to a common type (u32), there are no defined limits of kfb->afbc_size and fb->offsets[0] , so min_size can have an overflowed u32 value.
> 

Ack, my bad - thanks for the refresher on the promotion rules.

I think afbc_size is indirectly constrained, but offsets[0] may not
be.

-Brian

Re: [PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check

[Liviu Dudau]

On Wed, Feb 04, 2026 at 02:56:38PM +0000, Alexander Konyukhov wrote:
> Thank you for the replies.
> 
> According to ISO 9899 6.3.1 both operands are first converted to a common type (u32), there are no defined limits of kfb->afbc_size and fb->offsets[0] , so min_size can have an overflowed u32 value.

Brian has pointed out that just looking at the type of the result is not enough.

Acked-by: Liviu Dudau <liviu.dudau@arm.com>

Will push this into drm-misc-next later today.

Thanks for the fix!

Best regards,
Liviu

> 
> -----Original Message-----
> From: Liviu Dudau <liviu.dudau@arm.com> 
> Sent: Wednesday, February 4, 2026 4:25 PM
> To: Brian Starkey <brian.starkey@arm.com>
> Cc: Alexander Konyukhov <Alexander.Konyukhov@kaspersky.com>; Maarten Lankhorst <maarten.lankhorst@linux.intel.com>; Maxime Ripard <mripard@kernel.org>; Thomas Zimmermann <tzimmermann@suse.de>; David Airlie <airlied@gmail.com>; Simona Vetter <simona@ffwll.ch>; dri-devel@lists.freedesktop.org; linux-kernel@vger.kernel.org; lvc-project@linuxtesting.org; nd@arm.com
> Subject: Re: [PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check
> 
> Caution: This is an external email.
> 
> 
> 
> On Tue, Feb 03, 2026 at 09:43:12PM +0000, Brian Starkey wrote:
> > Hi Alexander,
> >
> > On Tue, Feb 03, 2026 at 04:48:46PM +0000, Alexander Konyukhov wrote:
> > > The AFBC framebuffer size validation calculates the minimum required 
> > > buffer size by adding the AFBC payload size to the framebuffer offset.
> > > This addition is performed without checking for integer overflow.
> > >
> > > If the addition oveflows, the size check may incorrectly succed and 
> > > allow userspace to provide an undersized drm_gem_object, potentially 
> > > leading to out-of-bounds memory access.
> > >
> > > Add usage of check_add_overflow() to safely compute the minimum 
> > > required size and reject the framebuffer if an overflow is detected.
> > > This makes the AFBC size validation more robust against malformed.
> > >
> > > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> > >
> > > Fixes: 65ad2392dd6d ("drm/komeda: Added AFBC support for komeda 
> > > driver")
> > > Signed-off-by: Alexander Konyukhov 
> > > <Alexander.Konyukhov@kaspersky.com>
> > > ---
> > >  drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c | 6 +++++-
> > >  1 file changed, 5 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c 
> > > b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> > > index 3ca461eb0a24..3cb34d03f7f8 100644
> > > --- a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> > > +++ b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> > > @@ -4,6 +4,8 @@
> > >   * Author: James.Qian.Wang <james.qian.wang@arm.com>
> > >   *
> > >   */
> > > +#include <linux/overflow.h>
> > > +
> > >  #include <drm/drm_device.h>
> > >  #include <drm/drm_fb_dma_helper.h>
> > >  #include <drm/drm_gem.h>
> > > @@ -93,7 +95,9 @@ komeda_fb_afbc_size_check(struct komeda_fb *kfb, struct drm_file *file,
> > >     kfb->afbc_size = kfb->offset_payload + n_blocks *
> > >                      ALIGN(bpp * AFBC_SUPERBLK_PIXELS / 8,
> > >                            AFBC_SUPERBLK_ALIGNMENT);
> > > -   min_size = kfb->afbc_size + fb->offsets[0];
> >
> > Can this really overflow? Is the concern a hypothetical ILP64 
> > situation?
> >
> > min_size is u64, kfb->afbc_size is u32, and fb->offsets[0] is unsigned 
> > int.
> 
> Yeah, I was thinking the same thing yesterday at the end of the work day when I looked at the patch. I don't think following the call flow you can end up with an overflow.
> 
> Best regards,
> Liviu
> 
> >
> > Thanks,
> > -Brian
> >
> > > +   if (check_add_overflow(kfb->afbc_size, fb->offsets[0], &min_size)) {
> > > +           goto check_failed;
> > > +   }
> > >     if (min_size > obj->size) {
> > >             DRM_DEBUG_KMS("afbc size check failed, obj_size: 0x%zx. min_size 0x%llx.\n",
> > >                           obj->size, min_size);
> > > --
> > > 2.43.0
> > >

Re: [PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check

[Fedor Pchelkin]

On Tue, 03. Feb 16:48, Alexander Konyukhov wrote:
> The AFBC framebuffer size validation calculates the minimum required
> buffer size by adding the AFBC payload size to the framebuffer offset.
> This addition is performed without checking for integer overflow.
> 
> If the addition oveflows, the size check may incorrectly succed and
> allow userspace to provide an undersized drm_gem_object, potentially
> leading to out-of-bounds memory access.
> 
> Add usage of check_add_overflow() to safely compute the minimum
> required size and reject the framebuffer if an overflow is detected.
> This makes the AFBC size validation more robust against malformed.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 65ad2392dd6d ("drm/komeda: Added AFBC support for komeda driver")
> Signed-off-by: Alexander Konyukhov <Alexander.Konyukhov@kaspersky.com>
> ---
>  drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> index 3ca461eb0a24..3cb34d03f7f8 100644
> --- a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> +++ b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c
> @@ -4,6 +4,8 @@
>   * Author: James.Qian.Wang <james.qian.wang@arm.com>
>   *
>   */
> +#include <linux/overflow.h>
> +
>  #include <drm/drm_device.h>
>  #include <drm/drm_fb_dma_helper.h>
>  #include <drm/drm_gem.h>
> @@ -93,7 +95,9 @@ komeda_fb_afbc_size_check(struct komeda_fb *kfb, struct drm_file *file,
>  	kfb->afbc_size = kfb->offset_payload + n_blocks *
>  			 ALIGN(bpp * AFBC_SUPERBLK_PIXELS / 8,
>  			       AFBC_SUPERBLK_ALIGNMENT);
> -	min_size = kfb->afbc_size + fb->offsets[0];
> +	if (check_add_overflow(kfb->afbc_size, fb->offsets[0], &min_size)) {
> +		goto check_failed;
> +	}

nit: extra braces around single-statement if-block are not needed per
kernel's coding style.

Another option is to cast one of the operands to u64 type and so perform
the addition in u64 and then proceed to the `min_size > obj->size` check
below.  Otherwise with the current patch it's pointless to declare
min_size as u64 - why u64 if its value is only allowed to be in u32 range
with the new check?

I think casting would probably be more appropriate here though it's up
to you to decide, thanks.

--
Fedor

>  	if (min_size > obj->size) {
>  		DRM_DEBUG_KMS("afbc size check failed, obj_size: 0x%zx. min_size 0x%llx.\n",
>  			      obj->size, min_size);
> -- 
> 2.43.0