Commit 0c4cd633 authored by Alex Hung's avatar Alex Hung Committed by Yuntao Liu
Browse files

drm/amd/display: Avoid overflow assignment in link_dp_cts 

mainline inclusion
from mainline-v6.12-rc1
commit a15268787b79fd183dd526cc16bec9af4f4e49a1
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRBP
CVE: CVE-2024-50016

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a15268787b79fd183dd526cc16bec9af4f4e49a1



--------------------------------

[ Upstream commit a15268787b79fd183dd526cc16bec9af4f4e49a1 ]

sampling_rate is an uint8_t but is assigned an unsigned int, and thus it
can overflow. As a result, sampling_rate is changed to uint32_t.

Similarly, LINK_QUAL_PATTERN_SET has a size of 2 bits, and it should
only be assigned to a value less or equal than 4.

This fixes 2 INTEGER_OVERFLOW issues reported by Coverity.

Signed-off-by: default avatarAlex Hung <alex.hung@amd.com>
Reviewed-by: default avatarWenjing Liu <wenjing.liu@amd.com>
Tested-by: default avatarDaniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: default avatarRodrigo Siqueira <rodrigo.siqueira@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarYuntao Liu <liuyuntao12@huawei.com>
parent d0f2f9b2

drivers/gpu/drm/amd/display/dc/dc_dp_types.h

+1 −1
Original line number Diff line number Diff line
@@ -721,7 +721,7 @@ struct dp_audio_test_data_flags { 
struct dp_audio_test_data {



	struct dp_audio_test_data_flags flags;

	uint8_t sampling_rate;

	uint32_t sampling_rate;

	uint8_t channel_count;

	uint8_t pattern_type;

	uint8_t pattern_period[8];

drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c

+2 −1
Original line number Diff line number Diff line
@@ -849,6 +849,7 @@ bool dp_set_test_pattern( 
			core_link_read_dpcd(link, DP_TRAINING_PATTERN_SET,

					    &training_pattern.raw,

					    sizeof(training_pattern));

			if (pattern <= PHY_TEST_PATTERN_END_DP11)

				training_pattern.v1_3.LINK_QUAL_PATTERN_SET = pattern;

			core_link_write_dpcd(link, DP_TRAINING_PATTERN_SET,

					     &training_pattern.raw,

drivers/gpu/drm/amd/display/include/dpcd_defs.h

+1 −0
Original line number Diff line number Diff line
@@ -76,6 +76,7 @@ enum dpcd_phy_test_patterns { 
	PHY_TEST_PATTERN_D10_2,

	PHY_TEST_PATTERN_SYMBOL_ERROR,

	PHY_TEST_PATTERN_PRBS7,

	PHY_TEST_PATTERN_END_DP11 = PHY_TEST_PATTERN_PRBS7,

	PHY_TEST_PATTERN_80BIT_CUSTOM,/* For DP1.2 only */

	PHY_TEST_PATTERN_CP2520_1,

	PHY_TEST_PATTERN_CP2520_2,