Nikita Zhandarovich b33386fabb drm/repaper: fix integer overflows in repeat functions ...

commit 4d098000ac upstream.

There are conditions, albeit somewhat unlikely, under which right hand
expressions, calculating the end of time period in functions like
repaper_frame_fixed_repeat(), may overflow.

For instance, if 'factor10x' in repaper_get_temperature() is high
enough (170), as is 'epd->stage_time' in repaper_probe(), then the
resulting value of 'end' will not fit in unsigned int expression.

Mitigate this by casting 'epd->factored_stage_time' to wider type before
any multiplication is done.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 3589211e9b ("drm/tinydrm: Add RePaper e-ink driver")
Cc: stable@vger.kernel.org
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Signed-off-by: Alex Lanzano <lanzano.alex@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250116134801.22067-1-n.zhandarovich@fintech.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-04-25 10:47:57 +02:00

..

arcpgu.c

…

bochs.c

…

cirrus.c

…

gm12u320.c

…

hx8357d.c

…

ili9163.c

…

ili9225.c

…

ili9341.c

…

ili9486.c

…

Kconfig

…

Makefile

…

mi0283qt.c

…

ofdrm.c

…

panel-mipi-dbi.c

…

repaper.c

…

simpledrm.c

…

st7586.c

…

st7735r.c

…