Hi Dave, Gerd, Friendly ping on this v2, sent August 8. The original ALLOC_SURF integer overflow allows a DRM_AUTH client to create a surface backed by a one-page BO but described to the device as up to 4 GiB.
The v2 computes the size in u64 (addressing a Sashiko review note about 32-bit wrap on the height+1 addition). Let me know if it needs any changes. Thanks, Aldo
