Commit 8987e18f authored by Alex Hung's avatar Alex Hung Committed by Li Huafei
Browse files

drm/amd/display: Avoid overflow from uint32_t to uint8_t 

mainline inclusion
from mainline-v6.11-rc1
commit d6b54900c564e35989cf6813e4071504fa0a90e0
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU7X
CVE: CVE-2024-47661

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6b54900c564e35989cf6813e4071504fa0a90e0



--------------------------------

[WHAT & HOW]
dmub_rb_cmd's ramping_boundary has size of uint8_t and it is assigned
0xFFFF. Fix it by changing it to uint8_t with value of 0xFF.

This fixes 2 INTEGER_OVERFLOW issues reported by Coverity.

Reviewed-by: default avatarRodrigo Siqueira <rodrigo.siqueira@amd.com>
Acked-by: default avatarZaeem Mohamed <zaeem.mohamed@amd.com>
Signed-off-by: default avatarAlex Hung <alex.hung@amd.com>
Tested-by: default avatarDaniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Conflicts:
	drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
	drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c
[ Not backport e53524cdcc02d(“drm/amd/display: Refactor HWSS into
component folder”), conflict due to file renaming. ]
Signed-off-by: default avatarLi Huafei <lihuafei1@huawei.com>
parent 9cb2bad7

drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c

+1 −1
Original line number Diff line number Diff line
@@ -262,7 +262,7 @@ bool dmub_abm_set_pipe(struct abm *abm, 
{

	union dmub_rb_cmd cmd;

	struct dc_context *dc = abm->ctx;

	uint32_t ramping_boundary = 0xFFFF;

	uint8_t ramping_boundary = 0xFF;



	memset(&cmd, 0, sizeof(cmd));

	cmd.abm_set_pipe.header.type = DMUB_CMD__ABM;

drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c

+1 −1
Original line number Diff line number Diff line
@@ -142,7 +142,7 @@ static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, 
{

	union dmub_rb_cmd cmd;

	struct dc_context *dc = abm->ctx;

	uint32_t ramping_boundary = 0xFFFF;

	uint8_t ramping_boundary = 0xFF;



	memset(&cmd, 0, sizeof(cmd));

	cmd.abm_set_pipe.header.type = DMUB_CMD__ABM;