drm/i915/fb: Check that the clear color fits within the BO

Make sure the user supplied offset[] for the clear color plane
fits within the actual BO. Note that we use tile units to track
the size here. All the other color/aux planes are already
being checked correctly.

Cc: Sagar Ghuge <[e-mail]>
Cc: Nanley Chery <[e-mail]>
Cc: Xi Ruoyao <[e-mail]>
Signed-off-by: Ville Syrjälä <[e-mail]>
Link: https://patchwork.freedesktop.org/patch/msgid/[e-mail]
Reviewed-by: José Roberto de Souza <[e-mail]>

drivers/gpu/drm/i915/display/intel_fb.c

···
 		 * arithmetic related to alignment and offset calculation.
 		 */
 		if (is_gen12_ccs_cc_plane(&fb->base, i)) {
+			unsigned int end;
+
 			if (!IS_ALIGNED(fb->base.offsets[i], 64)) {
 				drm_dbg_kms(&i915->drm,
 					    "fb misaligned clear color plane %d offset (0x%x)\n",
···
 				return -EINVAL;
 			}
 
+			if (check_add_overflow(fb->base.offsets[i], 64, &end)) {
+				drm_dbg_kms(&i915->drm,
+					    "fb bad clear color plane %d offset (0x%x)\n",
+					    i, fb->base.offsets[i]);
+				return -EINVAL;
+			}
+
+			max_size = max(max_size, DIV_ROUND_UP(end, tile_size));
 			continue;
 		}