From nobody Fri Dec 19 12:31:10 2025 Received: from mxhk.zte.com.cn (mxhk.zte.com.cn [63.216.63.40]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 31C0F14F72 for ; Wed, 20 Dec 2023 02:46:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zte.com.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zte.com.cn Received: from mxct.zte.com.cn (unknown [192.168.251.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mxhk.zte.com.cn (FangMail) with ESMTPS id 4Svyd457zFz8XrRJ for ; Wed, 20 Dec 2023 10:46:48 +0800 (CST) Received: from mse-fl2.zte.com.cn (unknown [10.5.228.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mxct.zte.com.cn (FangMail) with ESMTPS id 4Svycr233Gz4xVcb; Wed, 20 Dec 2023 10:46:36 +0800 (CST) Received: from xaxapp03.zte.com.cn ([10.88.97.17]) by mse-fl2.zte.com.cn with SMTP id 3BK2kTsI065941; Wed, 20 Dec 2023 10:46:29 +0800 (+08) (envelope-from yang.guang5@zte.com.cn) Received: from mapi (xaxapp03[null]) by mapi (Zmail) with MAPI id mid31; Wed, 20 Dec 2023 10:46:30 +0800 (CST) Date: Wed, 20 Dec 2023 10:46:30 +0800 (CST) X-Zmail-TransId: 2afb6582558662c-ceb76 X-Mailer: Zmail v1.0 Message-ID: <202312201046309071520@zte.com.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 From: To: Cc: , , , , , , , , , , , , , , , , , , Subject: =?UTF-8?B?W1BBVENIIGxpbnV4LW5leHRdIGRybS9hbWQvZGlzcGxheTogdXNlIGtjYWxsb2MgaW5zdGVhZCBvZiBvcGVuIGNvZGVkIGFyaXRobWV0aWM=?= X-MAIL: mse-fl2.zte.com.cn 3BK2kTsI065941 X-Fangmail-Gw-Spam-Type: 0 X-Fangmail-Anti-Spam-Filtered: true X-Fangmail-MID-QID: 65825598.000/4Svyd457zFz8XrRJ Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yang Guang Dynamic size calculations (especially multiplication) should not be=20 performed in memory allocator (or similar) function arguments due=20 to the risk of them overflowing. This could lead to values wrapping=20 around and a smaller allocation being made than the caller was=20 expecting. Using those allocations could lead to linear overflows=20 of heap memory and other misbehaviors.=20 Signed-off-by: Chen Haonan --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gp= u/drm/amd/display/amdgpu_dm/amdgpu_dm.c index d7ac020bd8af..d6d63bd7482e 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -9204,7 +9204,7 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_a= tomic_state *state) * Here we create an empty update on each plane. * To fix this, DC should permit updating only stream properties. */ - dummy_updates =3D kzalloc(sizeof(struct dc_surface_update) * MAX_SURFACE= S, GFP_ATOMIC); + dummy_updates =3D kcalloc(MAX_SURFACES, sizeof(struct dc_surface_update)= , GFP_ATOMIC); for (j =3D 0; j < status->plane_count; j++) dummy_updates[j].surface =3D status->plane_states[0]; --=20 2.25.1