This is a note to let you know that I've just added the patch titled
drm/amd/display: Avoid overflow assignment in link_dp_cts
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
drm-amd-display-avoid-overflow-assignment-in-link_dp.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 18543a80c0ca2838aa5e17d45ab80262c2b52e71
Author: Alex Hung <alex.hung@xxxxxxx>
Date: Wed Jul 17 09:17:56 2024 -0600
drm/amd/display: Avoid overflow assignment in link_dp_cts
[ Upstream commit a15268787b79fd183dd526cc16bec9af4f4e49a1 ]
sampling_rate is an uint8_t but is assigned an unsigned int, and thus it
can overflow. As a result, sampling_rate is changed to uint32_t.
Similarly, LINK_QUAL_PATTERN_SET has a size of 2 bits, and it should
only be assigned to a value less or equal than 4.
This fixes 2 INTEGER_OVERFLOW issues reported by Coverity.
Signed-off-by: Alex Hung <alex.hung@xxxxxxx>
Reviewed-by: Wenjing Liu <wenjing.liu@xxxxxxx>
Tested-by: Daniel Wheeler <daniel.wheeler@xxxxxxx>
Signed-off-by: Rodrigo Siqueira <rodrigo.siqueira@xxxxxxx>
Signed-off-by: Alex Deucher <alexander.deucher@xxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h
index 83719f5bea495..8df52f9ba0b7c 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h
@@ -721,7 +721,7 @@ struct dp_audio_test_data_flags {
struct dp_audio_test_data {
struct dp_audio_test_data_flags flags;
- uint8_t sampling_rate;
+ uint32_t sampling_rate;
uint8_t channel_count;
uint8_t pattern_type;
uint8_t pattern_period[8];
diff --git a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
index fe4282771cd07..8a97d96f7d8bb 100644
--- a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
+++ b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
@@ -849,7 +849,8 @@ bool dp_set_test_pattern(
core_link_read_dpcd(link, DP_TRAINING_PATTERN_SET,
&training_pattern.raw,
sizeof(training_pattern));
- training_pattern.v1_3.LINK_QUAL_PATTERN_SET = pattern;
+ if (pattern <= PHY_TEST_PATTERN_END_DP11)
+ training_pattern.v1_3.LINK_QUAL_PATTERN_SET = pattern;
core_link_write_dpcd(link, DP_TRAINING_PATTERN_SET,
&training_pattern.raw,
sizeof(training_pattern));
diff --git a/drivers/gpu/drm/amd/display/include/dpcd_defs.h b/drivers/gpu/drm/amd/display/include/dpcd_defs.h
index aee5170f5fb23..c246235e4afec 100644
--- a/drivers/gpu/drm/amd/display/include/dpcd_defs.h
+++ b/drivers/gpu/drm/amd/display/include/dpcd_defs.h
@@ -76,6 +76,7 @@ enum dpcd_phy_test_patterns {
PHY_TEST_PATTERN_D10_2,
PHY_TEST_PATTERN_SYMBOL_ERROR,
PHY_TEST_PATTERN_PRBS7,
+ PHY_TEST_PATTERN_END_DP11 = PHY_TEST_PATTERN_PRBS7,
PHY_TEST_PATTERN_80BIT_CUSTOM,/* For DP1.2 only */
PHY_TEST_PATTERN_CP2520_1,
PHY_TEST_PATTERN_CP2520_2,
