vpos (int) field multiplied by crtc_htotal (u16) may cause
implicit promotion of the latter and overflow the result causing
undefined behavior.
Cast one of the operands to unsigned int to avoid that.
Fixes: 3ed4351a83ca ("drm: Extract drm_vblank.[hc]")
Cc: Simona Vetter <[email protected]>
Cc: <[email protected]> # v4.13+
Signed-off-by: Krzysztof Karas <[email protected]>
---
drivers/gpu/drm/drm_vblank.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_vblank.c b/drivers/gpu/drm/drm_vblank.c
index 46f59883183d..8a3a82962494 100644
--- a/drivers/gpu/drm/drm_vblank.c
+++ b/drivers/gpu/drm/drm_vblank.c
@@ -779,7 +779,7 @@ drm_crtc_vblank_helper_get_vblank_timestamp_internal(
* since start of scanout at first display scanline. delta_ns
* can be negative if start of scanout hasn't happened yet.
*/
- delta_ns = div_s64(1000000LL * (vpos * mode->crtc_htotal + hpos),
+ delta_ns = div_s64(1000000LL * ((unsigned int)vpos * mode->crtc_htotal
+ hpos),
mode->crtc_clock);
/* Subtract time delta from raw timestamp to get final
--
2.34.1
--
Best Regards,
Krzysztof
