Merge tag 'exynos-drm-fixes-for-v4.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes

Fix a issue to display system memory region outside a gem buffer.

* tag 'exynos-drm-fixes-for-v4.13-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
  drm/exynos: forbid creating framebuffers from too small GEM buffers

1 files changed, 13 insertions, 1 deletions

diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index d48fd7c918f8..73217c281c9a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -145,13 +145,19 @@ static struct drm_framebuffer *
 exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                       const struct drm_mode_fb_cmd2 *mode_cmd)
 {
+        const struct drm_format_info *info = drm_get_format_info(dev, mode_cmd);
         struct exynos_drm_gem *exynos_gem[MAX_FB_BUFFER];
         struct drm_gem_object *obj;
         struct drm_framebuffer *fb;
         int i;
         int ret;
 
-        for (i = 0; i < drm_format_num_planes(mode_cmd->pixel_format); i++) {
+        for (i = 0; i < info->num_planes; i++) {
+                unsigned int height = (i == 0) ? mode_cmd->height :
+                                     DIV_ROUND_UP(mode_cmd->height, info->vsub);
+                unsigned long size = height * mode_cmd->pitches[i] +
+                                     mode_cmd->offsets[i];
+
                 obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[i]);
                 if (!obj) {
                         DRM_ERROR("failed to lookup gem object\n");
@@ -160,6 +166,12 @@ exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                 }
 
                 exynos_gem[i] = to_exynos_gem(obj);
+
+                if (size > exynos_gem[i]->size) {
+                        i++;
+                        ret = -EINVAL;
+                        goto err;
+                }
         }
 
         fb = exynos_drm_framebuffer_init(dev, mode_cmd, exynos_gem, i);