From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C342C36CDE9; Wed, 20 May 2026 16:35:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779294930; cv=none; b=p5Qvs/0HFMUD88wKBYUw2L5zzDBDXWOyVx+FhtXz6HQo5cRU3PfttXEsfEnmiqeQnn4W0HUGDyCB0KShaJ65NwjC95atgOWGw7XPN48bLM/xQ4VK/vs1bsVR2uBNsO0/04QMzD49EzB7fTiwtIcFdkKSj9gP3Jna0/kk9BHcPDU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779294930; c=relaxed/simple; bh=WdUpudvFd08riCXBNCoYOprxtxbiEh+BtzWHv8arA28=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=l4hY4ygGKdMDoMqs1NRnmJLXQuLft5a2nOA+H8h2SeQEcQj0gXtDOCAQY5AQOKhPz4NAAGFW3OXnfoaXedzqJr0f7cyrpzEqi0TXkHuCgp4Mot8RGGL8kPXkgox7tj+5b1ISF+SQvdwzVDeuGleguzf26R2Y7U045wN6u4HeuSc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=COjNAYrV; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="COjNAYrV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F2E5A1F000E9; Wed, 20 May 2026 16:35:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1779294929; bh=6+n926pjkK5lbB7u0mbkfQkyxX/qrtN79Iy070w68Cw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=COjNAYrV1w4ZZEIOP2DP5G20T2PDOxAZsJYbU/J84bqZlqg1EuOXsk+GE4aEQK77V JQm9sTL+M55q59988ubF/1pc0UGhusUxhMGGrtAKm2lry12NE1hjUzAaR5nrB4sUMy qIXSJbXshSfyZP5cjv2/2h3CMmz+aNNpt+rk5f+8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Alexander Konyukhov , Liviu Dudau , Sasha Levin Subject: [PATCH 7.0 0227/1146] drm/komeda: fix integer overflow in AFBC framebuffer size check Date: Wed, 20 May 2026 18:07:57 +0200 Message-ID: <20260520162153.391597662@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260520162148.390695140@linuxfoundation.org> References: <20260520162148.390695140@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.0-stable review patch. If anyone has any objections, please let me know. ------------------ From: Alexander Konyukhov [ Upstream commit 779ec12c85c9e4547519e3903a371a3b26a289de ] The AFBC framebuffer size validation calculates the minimum required buffer size by adding the AFBC payload size to the framebuffer offset. This addition is performed without checking for integer overflow. If the addition oveflows, the size check may incorrectly succed and allow userspace to provide an undersized drm_gem_object, potentially leading to out-of-bounds memory access. Add usage of check_add_overflow() to safely compute the minimum required size and reject the framebuffer if an overflow is detected. This makes the AFBC size validation more robust against malformed. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 65ad2392dd6d ("drm/komeda: Added AFBC support for komeda driver") Signed-off-by: Alexander Konyukhov Acked-by: Liviu Dudau Signed-off-by: Liviu Dudau Link: https://lore.kernel.org/r/20260203134907.1587067-1-Alexander.Konyukhov@kaspersky.com Signed-off-by: Sasha Levin --- drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c index 6ee909f8d5349..50e86f352838f 100644 --- a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c +++ b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c @@ -4,6 +4,8 @@ * Author: James.Qian.Wang * */ +#include + #include #include #include @@ -93,7 +95,9 @@ komeda_fb_afbc_size_check(struct komeda_fb *kfb, struct drm_file *file, kfb->afbc_size = kfb->offset_payload + n_blocks * ALIGN(bpp * AFBC_SUPERBLK_PIXELS / 8, AFBC_SUPERBLK_ALIGNMENT); - min_size = kfb->afbc_size + fb->offsets[0]; + if (check_add_overflow(kfb->afbc_size, fb->offsets[0], &min_size)) { + goto check_failed; + } if (min_size > obj->size) { DRM_DEBUG_KMS("afbc size check failed, obj_size: 0x%zx. min_size 0x%llx.\n", obj->size, min_size); -- 2.53.0