linux-stable.git/drivers/gpu/drm/sysfb, branch v7.2.5

drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug

2026-09-11T09:51:23+00:00

commit 958f35cbb8955ca3fa439cd9f2092cb42414aa8c upstream.

The is_avivo() function has a logic error where it compares a constant
to another constant instead of checking the device parameter:

  (PCI_VENDOR_ID_ATI_R600 >= 0x9400)

Signed-off-by: Shixiong Ou 
Reviewed-by: Thomas Zimmermann 
Fixes: f496834e1674 ("drm/ofdrm: Add per-model device function")
Signed-off-by: Thomas Zimmermann 
Cc:  # v6.2+
Link: https://patch.msgid.link/20260731111729.703116-1-oushixiong1025@163.com
Signed-off-by: Greg Kroah-Hartman

drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation

2026-09-11T09:51:23+00:00

commit c6f48e59ece0123f6a11527ad4d89b21c2d65b87 upstream.

The framebuffer size calculation `fb_size = linebytes * height` can
overflow when both values are large (e.g., 46341 * 46341 > INT_MAX).
Since linebytes and height are both int types, the multiplication is
performed as int * int, which results in undefined behavior on overflow.

Use check_mul_overflow() to detect and prevent this overflow, consistent
with the approach used in simpledrm.c and corebootdrm.c.

Signed-off-by: Shixiong Ou 
Reviewed-by: Thomas Zimmermann 
Signed-off-by: Thomas Zimmermann 
Fixes: c8a17756c425 ("drm/ofdrm: Add ofdrm for Open Firmware framebuffers")
Cc:  # v6.2+
Link: https://patch.msgid.link/20260825104134.669676-1-oushixiong1025@163.com
Signed-off-by: Greg Kroah-Hartman

drm/sysfb: simpledrm: Improve stride validation

2026-09-11T09:51:23+00:00

commit df6533f11688aa30be3bb883c7637f4ffdbb7cbd upstream.

Validate the computed stride against the maximum value INT_MAX.

Signed-off-by: Thomas Zimmermann 
Reviewed-by: Thierry Reding 
Reviewed-by: Maxime Ripard 
Reviewed-by: Javier Martinez Canillas 
Fixes: 7bfa5c7b28d6 ("drm/simpledrm: Compute linestride with drm_format_info_min_pitch()")
Cc:  # v6.1+
Link: https://patch.msgid.link/20260625094509.157581-5-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman

drm/sysfb: simpledrm: Improve panel-size validation

2026-09-11T09:51:23+00:00

commit 3a75a0761914d01c7362adf1f906cc1d1762c189 upstream.

Validate the panel size from the device-tree node against the
limitations of struct drm_display_mode. The type only stores sizes
in 16-bit fields. Fail transparently on errors; do not warn.

v3:
- move comments to a more prominent place (Thierry)
v2:
- only use initialized values in debugging output (Sashiko)

Signed-off-by: Thomas Zimmermann 
Reviewed-by: Thierry Reding 
Reviewed-by: Maxime Ripard 
Reviewed-by: Javier Martinez Canillas 
Fixes: 2a6d731a8f16 ("drm/simpledrm: Allow physical width and height configuration via panel node")
Cc: Rayyan Ansari 
Cc:  # v6.4+
Link: https://patch.msgid.link/20260625094509.157581-3-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman

drm/sysfb: simpledrm: Improve framebuffer-size validation

2026-09-11T09:51:23+00:00

commit 03f1a3545b721fa7fdadd00080e237519a286a97 upstream.

Validate the framebuffer size from the firmware against the
limitations of struct drm_display_mode. The type only stores sizes
in 16-bit fields. Fail probing on errors.

v2:
- remove unused function simplefb_get_validated_int0() (Sashiko)

Signed-off-by: Thomas Zimmermann 
Reviewed-by: Thierry Reding 
Reviewed-by: Maxime Ripard 
Reviewed-by: Javier Martinez Canillas 
Fixes: 11e8f5fd223b ("drm: Add simpledrm driver")
Cc:  # v5.14+
Fixes: 11e8f5fd223b ("drm: Add simpledrm driver")
Link: https://patch.msgid.link/20260625094509.157581-2-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman

Merge tag 'drm-fixes-2026-06-27' of https://gitlab.freedesktop.org/drm/kernel

2026-06-27T00:03:48+00:00

Pull drm fixes from Dave Airlie:
 "These are just the fixes from our fixes branch, all pretty small and
  scattered.

  sysfb:
   - drm/sysfb truncation and alignment fixes

  edid:
   - fix edid OOB read in tile parsing
   - increase displayid topology id to correct size

  nouveau:
   - fix error handling paths in nouveau

  amdxdna:
   - get_bo_info fix

  ivpu:
   - fix leak when error handling in ivpu"

* tag 'drm-fixes-2026-06-27' of https://gitlab.freedesktop.org/drm/kernel:
  drm/sysfb: Avoid truncating maximum stride
  drm/sysfb: Return errno code from drm_sysfb_get_visible_size()
  drm/sysfb: Avoid possible truncation with calculating visible size
  drm/sysfb: Do not page-align visible size of the framebuffer
  drm/edid: fix OOB read in drm_parse_tiled_block()
  drm/nouveau: fix reversed error cleanup order in ucopy functions
  drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
  accel/amdxdna: Use caller client for debug BO sync
  drm/displayid: fix Tiled Display Topology ID size
  accel/ivpu: fix HWS command queue leak on registration failure

drm/sysfb: Avoid truncating maximum stride

2026-06-22T09:03:23+00:00

Passing a maximum as 64-bit type to drm_sysfb_get_validated_int0()
can truncate the value to 32 bits. Use drm_sysfb_get_validated_size0(),
which uses 64-bit arithmetics. Then test the returned stride against
the limits of int to avoid truncations in the returned value. A valid
stride is in the range of [1, INT_MAX] inclusive.

Signed-off-by: Thomas Zimmermann 
Reported-by: Sashiko 
Closes: https://lore.kernel.org/dri-devel/20260617114016.5A5991F000E9@smtp.kernel.org/
Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
Fixes: a84eb6abe2b6 ("drm/sysfb: Add vesadrm for VESA displays")
Cc: Thomas Zimmermann 
Cc: Javier Martinez Canillas 
Cc: dri-devel@lists.freedesktop.org
Cc:  # v6.16+
Reviewed-by: Javier Martinez Canillas 
Link: https://patch.msgid.link/20260618084327.46567-5-tzimmermann@suse.de

drm/sysfb: Return errno code from drm_sysfb_get_visible_size()

2026-06-22T09:03:22+00:00

Change the return type of drm_sysfb_get_visible_size() to s64 so
that it returns a possible errno code from _get_validated_size0().
Fix callers to handle the errno code.

The currently returned unsigned type converts an errno code to a
very large size value, which drivers interpret as visible size of
the system framebuffer. Later efforts to reserve the framebuffer
resource fail.

The bug has been present since efidrm and vesadrm got merged. It
was then part of each driver.

Signed-off-by: Thomas Zimmermann 
Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
Fixes: a84eb6abe2b6 ("drm/sysfb: Add vesadrm for VESA displays")
Reviewed-by: Javier Martinez Canillas 
Cc: Thomas Zimmermann 
Cc: Javier Martinez Canillas 
Cc: dri-devel@lists.freedesktop.org
Cc:  # v6.16+
Link: https://patch.msgid.link/20260618084327.46567-4-tzimmermann@suse.de

drm/sysfb: Avoid possible truncation with calculating visible size

2026-06-22T09:03:21+00:00

Calculating the visible size of the system framebuffer can result in
truncation of the result. The calculation uses 32-bit arithmetics,
which can overflow if the values for height and stride are large. Fix
the issue by multiplying with mul_u32_u32().

Signed-off-by: Thomas Zimmermann 
Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
Fixes: a84eb6abe2b6 ("drm/sysfb: Add vesadrm for VESA displays")
Reported-by: Sashiko 
Closes: https://lore.kernel.org/dri-devel/20260617114027.1F2A71F000E9@smtp.kernel.org/
Cc: Thomas Zimmermann 
Cc: Javier Martinez Canillas 
Cc: dri-devel@lists.freedesktop.org
Cc:  # v6.16+
Reviewed-by: Javier Martinez Canillas 
Link: https://patch.msgid.link/20260618084327.46567-3-tzimmermann@suse.de

drm/sysfb: Do not page-align visible size of the framebuffer

2026-06-22T09:03:21+00:00

Only return the actually visible size of the system framebuffer in
drm_sysfb_get_visible_size_si(). Drivers use this size value for
reserving access to framebuffer memory. Increasing the value can
make later attempts to do so fail.

Signed-off-by: Thomas Zimmermann 
Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
Fixes: a84eb6abe2b6 ("drm/sysfb: Add vesadrm for VESA displays")
Reviewed-by: Javier Martinez Canillas 
Cc: Thomas Zimmermann 
Cc: Javier Martinez Canillas 
Cc: dri-devel@lists.freedesktop.org
Cc:  # v6.16+
Link: https://patch.msgid.link/20260618084327.46567-2-tzimmermann@suse.de