]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm/radeon: fix integer overflow in radeon_align_pitch()
authorWerner Kasselman <werner@verivus.ai>
Wed, 15 Apr 2026 22:13:52 +0000 (22:13 +0000)
committerAlex Deucher <alexander.deucher@amd.com>
Fri, 17 Apr 2026 19:41:16 +0000 (15:41 -0400)
commitce3b24eb3ee8f82de851535f516bf21f83e82259
tree62f97e8b91c5e9ca0d50246b3c7f993b30625008
parent06e7f7aa7ab7193615332fa83b5bdd98baefb76b
drm/radeon: fix integer overflow in radeon_align_pitch()

radeon_align_pitch() has the same kind of overflow issue as the old
amdgpu helper: both the alignment round-up add and the final
'aligned * cpp' calculation can overflow signed int.

If that wraps, radeon_mode_dumb_create() can end up returning an
invalid pitch or creating a zero-sized dumb buffer.

Fix this by using check_add_overflow() for the alignment round-up and
check_mul_overflow() for the final pitch calculation, returning 0 on
overflow. Also reject zero pitch and size in
radeon_mode_dumb_create().

Found via AST-based call-graph analysis using sqry.

Fixes: ff72145badb8 ("drm: dumb scanout create/mmap for intel/radeon (v3)")
Signed-off-by: Werner Kasselman <werner@verivus.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/radeon/radeon_gem.c