Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'drm-intel-next-fixes-2026-01-29' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next
- Prevent u64 underflow in intel_fbc_stolen_end
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: https://patch.msgid.link/aXsWGWjacEJ03rTs@jlahtine-mobl
+21
-8
+21
-8
drivers/gpu/drm/i915/display/intel_fbc.c
+21
-8
drivers/gpu/drm/i915/display/intel_fbc.c
···
809
809
810
810
static u64 intel_fbc_stolen_end(struct intel_display *display)
811
811
{
812
-
u64 end;
812
+
u64 end = intel_fbc_cfb_base_max(display);
813
813
814
-
/* The FBC hardware for BDW/SKL doesn't have access to the stolen
814
+
/*
815
+
* The FBC hardware for BDW/SKL doesn't have access to the stolen
815
816
* reserved range size, so it always assumes the maximum (8mb) is used.
816
817
* If we enable FBC using a CFB on that memory range we'll get FIFO
817
-
* underruns, even if that range is not reserved by the BIOS. */
818
+
* underruns, even if that range is not reserved by the BIOS.
819
+
*/
818
820
if (display->platform.broadwell ||
819
-
(DISPLAY_VER(display) == 9 && !display->platform.broxton))
820
-
end = intel_parent_stolen_area_size(display) - 8 * 1024 * 1024;
821
-
else
822
-
end = U64_MAX;
821
+
(DISPLAY_VER(display) == 9 && !display->platform.broxton)) {
822
+
u64 stolen_area_size = intel_parent_stolen_area_size(display);
823
823
824
-
return min(end, intel_fbc_cfb_base_max(display));
824
+
/*
825
+
* If stolen_area_size is less than SZ_8M, use
826
+
* intel_fbc_cfb_base_max instead. This should not happen,
827
+
* so warn if it does.
828
+
*/
829
+
if (drm_WARN_ON(display->drm,
830
+
check_sub_overflow(stolen_area_size,
831
+
SZ_8M, &stolen_area_size)))
832
+
return end;
833
+
834
+
return min(end, stolen_area_size);
835
+
}
836
+
837
+
return end;
825
838
}
826
839
827
840
static int intel_fbc_min_limit(const struct intel_plane_state *plane_state)