diff options
| author | Shixiong Ou <oushixiong@kylinos.cn> | 2026-08-25 18:41:34 +0800 |
|---|---|---|
| committer | Thomas Zimmermann <tzimmermann@suse.de> | 2026-08-26 08:50:09 +0200 |
| commit | c6f48e59ece0123f6a11527ad4d89b21c2d65b87 (patch) | |
| tree | 109d1f5ad041602c95d44d426449b452611b9a2e /scripts/objdiff | |
| parent | 5bb489b333237c1bf63a891a4362986253a0060a (diff) | |
| download | linux-next-c6f48e59ece0123f6a11527ad4d89b21c2d65b87.tar.gz linux-next-c6f48e59ece0123f6a11527ad4d89b21c2d65b87.zip | |
drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
The framebuffer size calculation `fb_size = linebytes * height` can
overflow when both values are large (e.g., 46341 * 46341 > INT_MAX).
Since linebytes and height are both int types, the multiplication is
performed as int * int, which results in undefined behavior on overflow.
Use check_mul_overflow() to detect and prevent this overflow, consistent
with the approach used in simpledrm.c and corebootdrm.c.
Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: c8a17756c425 ("drm/ofdrm: Add ofdrm for Open Firmware framebuffers")
Cc: <stable@vger.kernel.org> # v6.2+
Link: https://patch.msgid.link/20260825104134.669676-1-oushixiong1025@163.com
Diffstat (limited to 'scripts/objdiff')
0 files changed, 0 insertions, 0 deletions