[PATCH] drm: ssd130x, st7586, sysfb: fix damage clip and buffer allocation bounds

[Hui Peng]

Validate damage rectangle coordinates and buffer sizes in
drivers/gpu/drm/solomon/ssd130x.c, drivers/gpu/drm/sitronix/st7586.c,
and drivers/gpu/drm/sysfb/drm_sysfb_modeset.c.

Fixes: a61732e80867 ("drm: Add driver for Solomon SSD130x OLED displays")
Assisted-by: LLM
Signed-off-by: Hui Peng <benqu...@gmail.com>
---
diff --git a/drivers/gpu/drm/sitronix/st7586.c 
b/drivers/gpu/drm/sitronix/st7586.c
index 28b2245f6b79..ef69f1eb8ead 100644
--- a/drivers/gpu/drm/sitronix/st7586.c
+++ b/drivers/gpu/drm/sitronix/st7586.c
@@ -380,7 +380,7 @@ static int st7586_probe(struct spi_device *spi)
        dbi = &dbidev->dbi;
        drm = &dbidev->drm;
 
-       bufsize = (st7586_mode.vdisplay + 2) / 3 * st7586_mode.hdisplay;
+       bufsize = (st7586_mode.hdisplay + 2) / 3 * st7586_mode.vdisplay;
 
        dbi->reset = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH);
        if (IS_ERR(dbi->reset))
diff --git a/drivers/gpu/drm/solomon/ssd130x.c 
b/drivers/gpu/drm/solomon/ssd130x.c
index 0b0fc6fe3df2..bae080b12e7e 100644
--- a/drivers/gpu/drm/solomon/ssd130x.c
+++ b/drivers/gpu/drm/solomon/ssd130x.c
@@ -802,7 +802,7 @@ static int ssd132x_update_rect(struct ssd130x_device 
*ssd130x,
                /* Process pair of pixels and combine them into a single byte */
                for (j = 0; j < width; j += segment_width) {
                        u8 n1 = buf[i * width + j];
-                       u8 n2 = buf[i * width + j + 1];
+                       u8 n2 = (j + 1 < width) ? buf[i * width + j + 1] : 0;
 
                        data_array[array_idx++] = (n2 & 0xf0) | (n1 >> 4);
                }
diff --git a/drivers/gpu/drm/sysfb/drm_sysfb_modeset.c 
b/drivers/gpu/drm/sysfb/drm_sysfb_modeset.c
index d2de29caf89e..2909cb7581d0 100644
--- a/drivers/gpu/drm/sysfb/drm_sysfb_modeset.c
+++ b/drivers/gpu/drm/sysfb/drm_sysfb_modeset.c
@@ -376,17 +376,21 @@ void drm_sysfb_plane_helper_atomic_disable(struct 
drm_plane *plane,
        struct drm_device *dev = plane->dev;
        struct drm_sysfb_device *sysfb = to_drm_sysfb_device(dev);
        struct iosys_map dst = sysfb->fb_addr;
-       struct drm_plane_state *plane_state = 
drm_atomic_get_new_plane_state(state, plane);
+       struct drm_plane_state *old_plane_state = 
drm_atomic_get_old_plane_state(state, plane);
        void __iomem *dst_vmap = dst.vaddr_iomem; /* TODO: Use mapping 
abstraction */
        unsigned int dst_pitch = sysfb->fb_pitch;
        const struct drm_format_info *dst_format = sysfb->fb_format;
-       struct drm_rect dst_clip;
+       struct drm_rect dst_clip, fb_rect;
        unsigned long lines, linepixels, i;
        int idx;
 
-       drm_rect_init(&dst_clip,
-                     plane_state->src_x >> 16, plane_state->src_y >> 16,
-                     plane_state->src_w >> 16, plane_state->src_h >> 16);
+       if (!old_plane_state || !old_plane_state->visible)
+               return;
+
+       dst_clip = old_plane_state->dst;
+       drm_rect_init(&fb_rect, 0, 0, sysfb->fb_mode.hdisplay, 
sysfb->fb_mode.vdisplay);
+       if (!drm_rect_intersect(&dst_clip, &fb_rect))
+               return;
 
        lines = drm_rect_height(&dst_clip);
        linepixels = drm_rect_width(&dst_clip);