Hi Cyrille, On Tue, 20 Jan 2026 at 12:06, Cyrille Pitchen <[email protected]> wrote: > +static int mchp_gfx2d_ioctl_alloc_buffer(struct drm_device *dev, void *data, > + struct drm_file *file_priv) > +{ > + struct drm_mchp_gfx2d_alloc_buffer *args = data; > + struct mchp_gfx2d_gem_object *gfx2d_obj; > + enum dma_data_direction dir; > + struct drm_gem_object *obj; > + int ret; > + > + ret = to_dma_data_direction(args->direction, &dir); > + if (ret) > + return ret; > + > + if (!valid_pixel_format(args->format)) > + return -EINVAL; > + > + gfx2d_obj = mchp_gfx2d_gem_create_with_handle(file_priv, dev, > + args->size, dir, > + &args->handle); > + if (IS_ERR(gfx2d_obj)) > + return PTR_ERR(gfx2d_obj); > + > + gfx2d_obj->width = args->width; > + gfx2d_obj->height = args->height; > + gfx2d_obj->stride = args->stride;
You need to validate height*stride vs. the size here. Same on the import path. Cheers, Daniel
