]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()
authorWerner Kasselman <werner@verivus.ai>
Tue, 14 Apr 2026 05:08:42 +0000 (05:08 +0000)
committerAlex Deucher <alexander.deucher@amd.com>
Fri, 17 Apr 2026 19:41:13 +0000 (15:41 -0400)
commitfc3659f178d4a65599167d5a648bbeef4b0d4446
tree427ecede5edc36615115f8fd2666aa03d202acb5
parentad0150fa2fade906b1dfcbb1895037e5f39d9561
drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()

amdgpu_gem_align_pitch() is passed u32 width and cpp from dumb buffer
creation but uses signed int internally.  The round-up add and the
aligned * cpp multiplication can overflow, returning zero or a negative
pitch.  A zero pitch propagates to a zero-sized GEM object allocation
that reaches userspace via DRM_IOCTL_MODE_CREATE_DUMB.

Switch the helper to unsigned int and use check_add_overflow() /
check_mul_overflow() so wraparound returns zero.  Reject a zero pitch
or size in amdgpu_mode_dumb_create() rather than allocating a zero-
byte BO.

Fixes: 8e911ab770f7 ("drm: amdgpu: Replace drm_fb_get_bpp_depth() with drm_format_plane_cpp()")
Signed-off-by: Werner Kasselman <werner@verivus.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c