[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 5 May 2023 10:29:20 -0400
From: Rodrigo Vivi <rodrigo.vivi@...nel.org>
To: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
Cc: Jani Nikula <jani.nikula@...ux.intel.com>,
Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
Rodrigo Vivi <rodrigo.vivi@...el.com>,
Tvrtko Ursulin <tvrtko.ursulin@...ux.intel.com>,
David Airlie <airlied@...il.com>,
Daniel Vetter <daniel@...ll.ch>,
Ville Syrjälä
<ville.syrjala@...ux.intel.com>,
Ankit Nautiyal <ankit.k.nautiyal@...el.com>,
Manasi Navare <manasi.d.navare@...el.com>,
Stanislav Lisovskiy <stanislav.lisovskiy@...el.com>,
"Jason A. Donenfeld" <Jason@...c4.com>,
intel-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
linux-kernel@...r.kernel.org, lvc-project@...uxtesting.org
Subject: Re: [PATCH] drm/i915/dp: prevent potential div-by-zero
On Tue, Apr 18, 2023 at 07:04:30AM -0700, Nikita Zhandarovich wrote:
> drm_dp_dsc_sink_max_slice_count() may return 0 if something goes
> wrong on the part of the DSC sink and its DPCD register. This null
> value may be later used as a divisor in intel_dsc_compute_params(),
> which will lead to an error.
> In the unlikely event that this issue occurs, fix it by testing the
> return value of drm_dp_dsc_sink_max_slice_count() against zero.
>
> Found by Linux Verification Center (linuxtesting.org) with static
> analysis tool SVACE.
>
> Fixes: a4a157777c80 ("drm/i915/dp: Compute DSC pipe config in atomic check")
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@...el.com>
and pushed.
Thanks for the patch and sorry for the delay.
> ---
> drivers/gpu/drm/i915/display/intel_dp.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
> index 62cbab7402e9..c1825f8f885c 100644
> --- a/drivers/gpu/drm/i915/display/intel_dp.c
> +++ b/drivers/gpu/drm/i915/display/intel_dp.c
> @@ -1533,6 +1533,11 @@ int intel_dp_dsc_compute_config(struct intel_dp *intel_dp,
> pipe_config->dsc.slice_count =
> drm_dp_dsc_sink_max_slice_count(intel_dp->dsc_dpcd,
> true);
> + if (!pipe_config->dsc.slice_count) {
> + drm_dbg_kms(&dev_priv->drm, "Unsupported Slice Count %d\n",
> + pipe_config->dsc.slice_count);
> + return -EINVAL;
> + }
> } else {
> u16 dsc_max_output_bpp = 0;
> u8 dsc_dp_slice_count;
> --
> 2.25.1
>
Powered by blists - more mailing lists