| Message ID | 20230418140430.69902-1-n.zhandarovich@fintech.ru (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/i915/dp: prevent potential div-by-zero | expand |
On Tue, Apr 18, 2023 at 07:04:30AM -0700, Nikita Zhandarovich wrote: > drm_dp_dsc_sink_max_slice_count() may return 0 if something goes > wrong on the part of the DSC sink and its DPCD register. This null > value may be later used as a divisor in intel_dsc_compute_params(), > which will lead to an error. > In the unlikely event that this issue occurs, fix it by testing the > return value of drm_dp_dsc_sink_max_slice_count() against zero. > > Found by Linux Verification Center (linuxtesting.org) with static > analysis tool SVACE. > > Fixes: a4a157777c80 ("drm/i915/dp: Compute DSC pipe config in atomic check") > Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> and pushed. Thanks for the patch and sorry for the delay. > --- > drivers/gpu/drm/i915/display/intel_dp.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c > index 62cbab7402e9..c1825f8f885c 100644 > --- a/drivers/gpu/drm/i915/display/intel_dp.c > +++ b/drivers/gpu/drm/i915/display/intel_dp.c > @@ -1533,6 +1533,11 @@ int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, > pipe_config->dsc.slice_count = > drm_dp_dsc_sink_max_slice_count(intel_dp->dsc_dpcd, > true); > + if (!pipe_config->dsc.slice_count) { > + drm_dbg_kms(&dev_priv->drm, "Unsupported Slice Count %d\n", > + pipe_config->dsc.slice_count); > + return -EINVAL; > + } > } else { > u16 dsc_max_output_bpp = 0; > u8 dsc_dp_slice_count; > -- > 2.25.1 >
diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c index 62cbab7402e9..c1825f8f885c 100644 --- a/drivers/gpu/drm/i915/display/intel_dp.c +++ b/drivers/gpu/drm/i915/display/intel_dp.c @@ -1533,6 +1533,11 @@ int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, pipe_config->dsc.slice_count = drm_dp_dsc_sink_max_slice_count(intel_dp->dsc_dpcd, true); + if (!pipe_config->dsc.slice_count) { + drm_dbg_kms(&dev_priv->drm, "Unsupported Slice Count %d\n", + pipe_config->dsc.slice_count); + return -EINVAL; + } } else { u16 dsc_max_output_bpp = 0; u8 dsc_dp_slice_count;
drm_dp_dsc_sink_max_slice_count() may return 0 if something goes wrong on the part of the DSC sink and its DPCD register. This null value may be later used as a divisor in intel_dsc_compute_params(), which will lead to an error. In the unlikely event that this issue occurs, fix it by testing the return value of drm_dp_dsc_sink_max_slice_count() against zero. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: a4a157777c80 ("drm/i915/dp: Compute DSC pipe config in atomic check") Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> --- drivers/gpu/drm/i915/display/intel_dp.c | 5 +++++ 1 file changed, 5 insertions(+)