drm/xen-front: cast calculation to __u64 in xen_drm_drv_dumb_create()

[PATCH] drm/xen-front: cast calculation to __u64 in xen_drm_drv_dumb_create()

Gax-c posted 1 patch 1 month ago

Download mbox

Failed in applying to current master (apply log)

drivers/gpu/drm/xen/xen_drm_front.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Expand all Fold all

[PATCH] drm/xen-front: cast calculation to __u64 in xen_drm_drv_dumb_create()

Posted by Gax-c 1 month ago

From: Zichen Xie <zichenxie0106@gmail.com>

Like commit b0b0d811eac6 ("drm/mediatek: Fix coverity issue with
unintentional integer overflow"), directly multiply args->pitch and
args->height may lead to integer overflow. Add a cast to avoid it.

Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
---
 drivers/gpu/drm/xen/xen_drm_front.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xen/xen_drm_front.c b/drivers/gpu/drm/xen/xen_drm_front.c
index aab79c5e34c2..639aad26f6c9 100644
--- a/drivers/gpu/drm/xen/xen_drm_front.c
+++ b/drivers/gpu/drm/xen/xen_drm_front.c
@@ -415,7 +415,7 @@ static int xen_drm_drv_dumb_create(struct drm_file *filp,
 	 * For details also see drm_gem_handle_create
 	 */
 	args->pitch = DIV_ROUND_UP(args->width * args->bpp, 8);
-	args->size = args->pitch * args->height;
+	args->size = (__u64)args->pitch * args->height;
 
 	obj = xen_drm_front_gem_create(dev, args->size);
 	if (IS_ERR(obj)) {
-- 
2.34.1