drm/mediatek: Fix coverity issue with unintentional integer overflow

commit b0b0d811eac6b4c52cb9ad632fa6384cf48869e7 upstream.

1. Instead of multiplying 2 variable of different types. Change to
assign a value of one variable and then multiply the other variable.

2. Add a int variable for multiplier calculation instead of calculating
different types multiplier with dma_addr_t variable directly.

Fixes: 1a64a7aff8da ("drm/mediatek: Fix cursor plane no update")
Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com>
Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patchwork.kernel.org/project/dri-devel/patch/20230907091425.9526-1-jason-jh.lin@mediatek.com/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
[ For certain code segments with coverity issue do not exist in
  function mtk_plane_update_new_state(), those not present in v6.1 are
  not back ported. ]
Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
index 21e584038581d6c8c1cef4df28a81a745eeb85eb..336a6ee792c6fb08be3ba5ef3869fa48a8d0df28 100644 (file)
--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
@@ -119,7 +119,14 @@ int mtk_drm_gem_dumb_create(struct drm_file *file_priv, struct drm_device *dev,
        int ret;
 
        args->pitch = DIV_ROUND_UP(args->width * args->bpp, 8);
-       args->size = args->pitch * args->height;
+
+       /*
+        * Multiply 2 variables of different types,
+        * for example: args->size = args->spacing * args->height;
+        * may cause coverity issue with unintentional overflow.
+        */
+       args->size = args->pitch;
+       args->size *= args->height;
 
        mtk_gem = mtk_drm_gem_create(dev, args->size, false);
        if (IS_ERR(mtk_gem))

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_plane.c b/drivers/gpu/drm/mediatek/mtk_drm_plane.c
index 30d361671aa9ca571d13a59d7830f6e972c420df..fb062e52eb123513f30535d272c42c616bb48a66 100644 (file)
--- a/drivers/gpu/drm/mediatek/mtk_drm_plane.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_plane.c
@@ -120,6 +120,7 @@ static void mtk_plane_update_new_state(struct drm_plane_state *new_state,
        struct mtk_drm_gem_obj *mtk_gem;
        unsigned int pitch, format;
        dma_addr_t addr;
+       int offset;
 
        gem = fb->obj[0];
        mtk_gem = to_mtk_gem_obj(gem);
@@ -127,8 +128,16 @@ static void mtk_plane_update_new_state(struct drm_plane_state *new_state,
        pitch = fb->pitches[0];
        format = fb->format->format;
 
-       addr += (new_state->src.x1 >> 16) * fb->format->cpp[0];
-       addr += (new_state->src.y1 >> 16) * pitch;
+       /*
+        * Using dma_addr_t variable to calculate with multiplier of different types,
+        * for example: addr += (new_state->src.x1 >> 16) * fb->format->cpp[0];
+        * may cause coverity issue with unintentional overflow.
+        */
+       offset = (new_state->src.x1 >> 16) * fb->format->cpp[0];
+       addr += offset;
+       offset = (new_state->src.y1 >> 16) * pitch;
+       addr += offset;
+
 
        mtk_plane_state->pending.enable = true;
        mtk_plane_state->pending.pitch = pitch;