From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 2996A2D8768 for ; Wed, 4 Feb 2026 15:07:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770217640; cv=none; b=e25AxmV06vPdbxQmBtKvohv9S9JzBD67Jh1Mtpkp87JA3HSxCiM7PLGZnVUoukSKD734uGjW1/4f80QqvW3/4KncEiJlts2ySEVs/uYp3xGd+OOrE9goAWmDmLKHos+rtWNafHjZIPnYj+AUJHz31SUWV8zhwHqc6HjrlFUJ/to= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770217640; c=relaxed/simple; bh=UEu/YDAgE/rLGIgby02mYJX+yCUqAuVT3eOhqYfATn8=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=eTMrtrD9QpIKy9GhLmsdfNMfz+z195sob7QeASabGelpX9bUTCBlBykyq9uvJak7ptkur2++ROw0jmYV3xrIX4IuRaAocxR+haURmp8pLDrBqJLz7r28m5qL/4I/vW4U2xq1x/5e290Uhv3PvvDaG5KwzDokqLQfstby5R/4dUI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 9C024339 for ; Wed, 4 Feb 2026 07:07:12 -0800 (PST) Received: from [192.168.0.1] (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id C58D13F778 for ; Wed, 4 Feb 2026 07:07:18 -0800 (PST) Date: Wed, 4 Feb 2026 15:05:39 +0000 From: Liviu Dudau To: Alexander Konyukhov Cc: Brian Starkey , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , "dri-devel@lists.freedesktop.org" , "linux-kernel@vger.kernel.org" , "lvc-project@linuxtesting.org" , "nd@arm.com" Subject: Re: [PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check Message-ID: References: <20260203134907.1587067-1-Alexander.Konyukhov@kaspersky.com> <57df230af1624c679a947317152fd8ed@kaspersky.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <57df230af1624c679a947317152fd8ed@kaspersky.com> On Wed, Feb 04, 2026 at 02:56:38PM +0000, Alexander Konyukhov wrote: > Thank you for the replies. > > According to ISO 9899 6.3.1 both operands are first converted to a common type (u32), there are no defined limits of kfb->afbc_size and fb->offsets[0] , so min_size can have an overflowed u32 value. Yes, but according to the komeda_framebuffer.c file, line 48, the min_size is an u64 variable, so it can hold the result of adding two u32 values safely. Best regards, Liviu > > -----Original Message----- > From: Liviu Dudau > Sent: Wednesday, February 4, 2026 4:25 PM > To: Brian Starkey > Cc: Alexander Konyukhov ; Maarten Lankhorst ; Maxime Ripard ; Thomas Zimmermann ; David Airlie ; Simona Vetter ; dri-devel@lists.freedesktop.org; linux-kernel@vger.kernel.org; lvc-project@linuxtesting.org; nd@arm.com > Subject: Re: [PATCH] drm/komeda: fix integer overflow in AFBC framebuffer size check > > Caution: This is an external email. > > > > On Tue, Feb 03, 2026 at 09:43:12PM +0000, Brian Starkey wrote: > > Hi Alexander, > > > > On Tue, Feb 03, 2026 at 04:48:46PM +0000, Alexander Konyukhov wrote: > > > The AFBC framebuffer size validation calculates the minimum required > > > buffer size by adding the AFBC payload size to the framebuffer offset. > > > This addition is performed without checking for integer overflow. > > > > > > If the addition oveflows, the size check may incorrectly succed and > > > allow userspace to provide an undersized drm_gem_object, potentially > > > leading to out-of-bounds memory access. > > > > > > Add usage of check_add_overflow() to safely compute the minimum > > > required size and reject the framebuffer if an overflow is detected. > > > This makes the AFBC size validation more robust against malformed. > > > > > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > > > > > Fixes: 65ad2392dd6d ("drm/komeda: Added AFBC support for komeda > > > driver") > > > Signed-off-by: Alexander Konyukhov > > > > > > --- > > > drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c | 6 +++++- > > > 1 file changed, 5 insertions(+), 1 deletion(-) > > > > > > diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c > > > b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c > > > index 3ca461eb0a24..3cb34d03f7f8 100644 > > > --- a/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c > > > +++ b/drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c > > > @@ -4,6 +4,8 @@ > > > * Author: James.Qian.Wang > > > * > > > */ > > > +#include > > > + > > > #include > > > #include > > > #include > > > @@ -93,7 +95,9 @@ komeda_fb_afbc_size_check(struct komeda_fb *kfb, struct drm_file *file, > > > kfb->afbc_size = kfb->offset_payload + n_blocks * > > > ALIGN(bpp * AFBC_SUPERBLK_PIXELS / 8, > > > AFBC_SUPERBLK_ALIGNMENT); > > > - min_size = kfb->afbc_size + fb->offsets[0]; > > > > Can this really overflow? Is the concern a hypothetical ILP64 > > situation? > > > > min_size is u64, kfb->afbc_size is u32, and fb->offsets[0] is unsigned > > int. > > Yeah, I was thinking the same thing yesterday at the end of the work day when I looked at the patch. I don't think following the call flow you can end up with an overflow. > > Best regards, > Liviu > > > > > Thanks, > > -Brian > > > > > + if (check_add_overflow(kfb->afbc_size, fb->offsets[0], &min_size)) { > > > + goto check_failed; > > > + } > > > if (min_size > obj->size) { > > > DRM_DEBUG_KMS("afbc size check failed, obj_size: 0x%zx. min_size 0x%llx.\n", > > > obj->size, min_size); > > > -- > > > 2.43.0 > > >