This is a note to let you know that I've just added the patch titled
drm/sysfb: Avoid possible truncation with calculating visible size
to the 7.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
drm-sysfb-avoid-possible-truncation-with-calculating-visible-size.patch
and it can be found in the queue-7.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From b771974988ec7ce077a7246fa0fa588c246fe581 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <[email protected]>
Date: Thu, 18 Jun 2026 10:41:58 +0200
Subject: drm/sysfb: Avoid possible truncation with calculating visible size
From: Thomas Zimmermann <[email protected]>
commit b771974988ec7ce077a7246fa0fa588c246fe581 upstream.
Calculating the visible size of the system framebuffer can result in
truncation of the result. The calculation uses 32-bit arithmetics,
which can overflow if the values for height and stride are large. Fix
the issue by multiplying with mul_u32_u32().
Signed-off-by: Thomas Zimmermann <[email protected]>
Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
Fixes: a84eb6abe2b6 ("drm/sysfb: Add vesadrm for VESA displays")
Reported-by: Sashiko <[email protected]>
Closes:
https://lore.kernel.org/dri-devel/[email protected]/
Cc: Thomas Zimmermann <[email protected]>
Cc: Javier Martinez Canillas <[email protected]>
Cc: [email protected]
Cc: <[email protected]> # v6.16+
Reviewed-by: Javier Martinez Canillas <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c
+++ b/drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c
@@ -2,6 +2,7 @@
#include <linux/export.h>
#include <linux/limits.h>
+#include <linux/math64.h>
#include <linux/minmax.h>
#include <linux/screen_info.h>
@@ -73,7 +74,7 @@ EXPORT_SYMBOL(drm_sysfb_get_stride_si);
u64 drm_sysfb_get_visible_size_si(struct drm_device *dev, const struct
screen_info *si,
unsigned int height, unsigned int stride, u64
size)
{
- u64 vsize = height * stride;
+ u64 vsize = mul_u32_u32(height, stride);
return drm_sysfb_get_validated_size0(dev, "visible size", vsize, size);
}
Patches currently in stable-queue which might be from [email protected] are
queue-7.1/drm-tests-shmem-set-dma-mask-to-64-bit-in-drm_gem_sh.patch
queue-7.1/drm-exynos-fbdev-remove-offset-into-screen_buffer.patch
queue-7.1/drm-sysfb-avoid-possible-truncation-with-calculating-visible-size.patch
queue-7.1/drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch
queue-7.1/drm-sysfb-do-not-page-align-visible-size-of-the-framebuffer.patch
queue-7.1/drm-sysfb-return-errno-code-from-drm_sysfb_get_visible_size.patch
queue-7.1/drm-sysfb-avoid-truncating-maximum-stride.patch
