| From 2a30f9d642b0bf0605af0df307fdb6022ec6c2d6 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 19 Mar 2025 01:30:11 +0000 |
| Subject: fbdev: sm501fb: Add some geometry checks. |
| |
| From: Danila Chernetsov <listdansp@mail.ru> |
| |
| [ Upstream commit aee50bd88ea5fde1ff4cc021385598f81a65830c ] |
| |
| Added checks for xoffset, yoffset settings. |
| Incorrect settings of these parameters can lead to errors |
| in sm501fb_pan_ functions. |
| |
| Found by Linux Verification Center (linuxtesting.org) with SVACE. |
| |
| Fixes: 5fc404e47bdf ("[PATCH] fb: SM501 framebuffer driver") |
| Signed-off-by: Danila Chernetsov <listdansp@mail.ru> |
| Signed-off-by: Helge Deller <deller@gmx.de> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/video/fbdev/sm501fb.c | 7 +++++++ |
| 1 file changed, 7 insertions(+) |
| |
| diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c |
| index f743bfbde2a6c..bbbc9de06a81b 100644 |
| --- a/drivers/video/fbdev/sm501fb.c |
| +++ b/drivers/video/fbdev/sm501fb.c |
| @@ -326,6 +326,13 @@ static int sm501fb_check_var(struct fb_var_screeninfo *var, |
| if (var->xres_virtual > 4096 || var->yres_virtual > 2048) |
| return -EINVAL; |
| |
| + /* geometry sanity checks */ |
| + if (var->xres + var->xoffset > var->xres_virtual) |
| + return -EINVAL; |
| + |
| + if (var->yres + var->yoffset > var->yres_virtual) |
| + return -EINVAL; |
| + |
| /* can cope with 8,16 or 32bpp */ |
| |
| if (var->bits_per_pixel <= 8) |
| -- |
| 2.39.5 |
| |
