[PATCH] drm: ssd130x, st7586, sysfb: fix damage clip and buffer allocation bounds

[Hui Peng]

Validate damage rectangle coordinates and buffer sizes in
drivers/gpu/drm/solomon/ssd130x.c, drivers/gpu/drm/sitronix/st7586.c,
and drivers/gpu/drm/sysfb/drm_sysfb_modeset.c.

Fixes: a61732e80867 ("drm: Add driver for Solomon SSD130x OLED displays")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
diff --git a/drivers/gpu/drm/sitronix/st7586.c b/drivers/gpu/drm/sitronix/st7586.c
index 28b2245f6b79..ef69f1eb8ead 100644
--- a/drivers/gpu/drm/sitronix/st7586.c
+++ b/drivers/gpu/drm/sitronix/st7586.c
@@ -380,7 +380,7 @@ static int st7586_probe(struct spi_device *spi)
 	dbi = &dbidev->dbi;
 	drm = &dbidev->drm;
 
-	bufsize = (st7586_mode.vdisplay + 2) / 3 * st7586_mode.hdisplay;
+	bufsize = (st7586_mode.hdisplay + 2) / 3 * st7586_mode.vdisplay;
 
 	dbi->reset = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH);
 	if (IS_ERR(dbi->reset))
diff --git a/drivers/gpu/drm/solomon/ssd130x.c b/drivers/gpu/drm/solomon/ssd130x.c
index 0b0fc6fe3df2..bae080b12e7e 100644
--- a/drivers/gpu/drm/solomon/ssd130x.c
+++ b/drivers/gpu/drm/solomon/ssd130x.c
@@ -802,7 +802,7 @@ static int ssd132x_update_rect(struct ssd130x_device *ssd130x,
 		/* Process pair of pixels and combine them into a single byte */
 		for (j = 0; j < width; j += segment_width) {
 			u8 n1 = buf[i * width + j];
-			u8 n2 = buf[i * width + j + 1];
+			u8 n2 = (j + 1 < width) ? buf[i * width + j + 1] : 0;
 
 			data_array[array_idx++] = (n2 & 0xf0) | (n1 >> 4);
 		}
diff --git a/drivers/gpu/drm/sysfb/drm_sysfb_modeset.c b/drivers/gpu/drm/sysfb/drm_sysfb_modeset.c
index d2de29caf89e..2909cb7581d0 100644
--- a/drivers/gpu/drm/sysfb/drm_sysfb_modeset.c
+++ b/drivers/gpu/drm/sysfb/drm_sysfb_modeset.c
@@ -376,17 +376,21 @@ void drm_sysfb_plane_helper_atomic_disable(struct drm_plane *plane,
 	struct drm_device *dev = plane->dev;
 	struct drm_sysfb_device *sysfb = to_drm_sysfb_device(dev);
 	struct iosys_map dst = sysfb->fb_addr;
-	struct drm_plane_state *plane_state = drm_atomic_get_new_plane_state(state, plane);
+	struct drm_plane_state *old_plane_state = drm_atomic_get_old_plane_state(state, plane);
 	void __iomem *dst_vmap = dst.vaddr_iomem; /* TODO: Use mapping abstraction */
 	unsigned int dst_pitch = sysfb->fb_pitch;
 	const struct drm_format_info *dst_format = sysfb->fb_format;
-	struct drm_rect dst_clip;
+	struct drm_rect dst_clip, fb_rect;
 	unsigned long lines, linepixels, i;
 	int idx;
 
-	drm_rect_init(&dst_clip,
-		      plane_state->src_x >> 16, plane_state->src_y >> 16,
-		      plane_state->src_w >> 16, plane_state->src_h >> 16);
+	if (!old_plane_state || !old_plane_state->visible)
+		return;
+
+	dst_clip = old_plane_state->dst;
+	drm_rect_init(&fb_rect, 0, 0, sysfb->fb_mode.hdisplay, sysfb->fb_mode.vdisplay);
+	if (!drm_rect_intersect(&dst_clip, &fb_rect))
+		return;
 
 	lines = drm_rect_height(&dst_clip);
 	linepixels = drm_rect_width(&dst_clip);