[PATCH] drm/sitronix: st7571: fix hwbuf heap buffer overflow from unaligned nlines

[PATCH] drm/sitronix: st7571: fix hwbuf heap buffer overflow from unaligned nlines

[Hui Peng]

In st7571_fb_blit_rect() (drivers/gpu/drm/sitronix/st7571.c), align y1
down and y2 up to multiples of 8 rows before computing nlines so the
byte count written into st7571->hwbuf matches the allocated page-aligned
buffer capacity and cannot overflow st7571->hwbuf.

Fixes: b362de167daf ("drm/sitronix/st7571: split up the driver into a common and an i2c part")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/drivers/gpu/drm/sitronix/st7571.c b/drivers/gpu/drm/sitronix/st7571.c
index 20954c33eca9..e1e95b360255 100644
--- a/drivers/gpu/drm/sitronix/st7571.c
+++ b/drivers/gpu/drm/sitronix/st7571.c
@@ -827,7 +827,8 @@ struct st7571_device *st7571_probe(struct device *dev,
 	st7571->regmap = regmap;
 
 	st7571->hwbuf = devm_kzalloc(st7571->dev,
-				     (st7571->nlines * st7571->ncols * st7571->bpp) / 8,
+				     (round_up(st7571->nlines, 8) *
+				      st7571->ncols * st7571->bpp) / 8,
 				     GFP_KERNEL);
 	if (!st7571->hwbuf)
 		return ERR_PTR(-ENOMEM);