shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-03-26 04:20:23 +09:00
Code Issues Packages Projects Releases Wiki Activity

drm/amd/display: Fix UBSAN: shift-out-of-bounds warning

Browse Source 
[ Upstream commit 54718747a6 ]

[Why]
On NAVI14 CONFIG_UBSAN reported shift-out-of-bounds at
display_rq_dlg_calc_20v2.c:304:38

rq_param->misc.rq_c.blk256_height is 0 when chroma(*_c) is invalid.
dml_log2 returns -1023 for log2(0), although log2(0) is undefined.

Which ended up as:
rq_param->dlg.rq_c.swath_height = 1 << -1023

[How]
Fix applied on all dml versions.
1. Ensure dml_log2 is only called if the argument is greater than 0.
2. Subtract req128_l/req128_c from log2_swath_height_l/log2_swath_height_c
   only when it is greater than 0.

Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Anson Jacob <Anson.Jacob@amd.com>
Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Reviewed-by: Jun Lei <Jun.Lei@amd.com>
Acked-by: Solomon Chiu <solomon.chiu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Anson Jacob
2021-03-01 14:25:44 -05:00
committed by Greg Kroah-Hartman
parent cc6215d94d
commit 081cec7846
5 changed files with 115 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c
View File

@@ -293,13 +293,31 @@ static void handle_det_buf_split(struct display_mode_lib *mode_lib,
if (surf_linear) {
log2_swath_height_l = 0;
log2_swath_height_c = 0;
} else if (!surf_vert) {
log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l;
log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c;
} else {
log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l;
log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c;
unsigned int swath_height_l;
unsigned int swath_height_c;
if (!surf_vert) {
swath_height_l = rq_param->misc.rq_l.blk256_height;
swath_height_c = rq_param->misc.rq_c.blk256_height;
} else {
swath_height_l = rq_param->misc.rq_l.blk256_width;
swath_height_c = rq_param->misc.rq_c.blk256_width;
}
if (swath_height_l > 0)
log2_swath_height_l = dml_log2(swath_height_l);
if (req128_l && log2_swath_height_l > 0)
log2_swath_height_l -= 1;
if (swath_height_c > 0)
log2_swath_height_c = dml_log2(swath_height_c);
if (req128_c && log2_swath_height_c > 0)
log2_swath_height_c -= 1;
}
rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l;
rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c;

28
drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c
View File

@@ -293,13 +293,31 @@ static void handle_det_buf_split(struct display_mode_lib *mode_lib,
if (surf_linear) {
log2_swath_height_l = 0;
log2_swath_height_c = 0;
} else if (!surf_vert) {
log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l;
log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c;
} else {
log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l;
log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c;
unsigned int swath_height_l;
unsigned int swath_height_c;
if (!surf_vert) {
swath_height_l = rq_param->misc.rq_l.blk256_height;
swath_height_c = rq_param->misc.rq_c.blk256_height;
} else {
swath_height_l = rq_param->misc.rq_l.blk256_width;
swath_height_c = rq_param->misc.rq_c.blk256_width;
}
if (swath_height_l > 0)
log2_swath_height_l = dml_log2(swath_height_l);
if (req128_l && log2_swath_height_l > 0)
log2_swath_height_l -= 1;
if (swath_height_c > 0)
log2_swath_height_c = dml_log2(swath_height_c);
if (req128_c && log2_swath_height_c > 0)
log2_swath_height_c -= 1;
}
rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l;
rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c;

28
drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c
View File

@@ -277,13 +277,31 @@ static void handle_det_buf_split(
if (surf_linear) {
log2_swath_height_l = 0;
log2_swath_height_c = 0;
} else if (!surf_vert) {
log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l;
log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c;
} else {
log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l;
log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c;
unsigned int swath_height_l;
unsigned int swath_height_c;
if (!surf_vert) {
swath_height_l = rq_param->misc.rq_l.blk256_height;
swath_height_c = rq_param->misc.rq_c.blk256_height;
} else {
swath_height_l = rq_param->misc.rq_l.blk256_width;
swath_height_c = rq_param->misc.rq_c.blk256_width;
}
if (swath_height_l > 0)
log2_swath_height_l = dml_log2(swath_height_l);
if (req128_l && log2_swath_height_l > 0)
log2_swath_height_l -= 1;
if (swath_height_c > 0)
log2_swath_height_c = dml_log2(swath_height_c);
if (req128_c && log2_swath_height_c > 0)
log2_swath_height_c -= 1;
}
rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l;
rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c;

28
drivers/gpu/drm/amd/display/dc/dml/dcn30/display_rq_dlg_calc_30.c
View File

@@ -237,13 +237,31 @@ static void handle_det_buf_split(struct display_mode_lib *mode_lib,
if (surf_linear) {
log2_swath_height_l = 0;
log2_swath_height_c = 0;
} else if (!surf_vert) {
log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l;
log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c;
} else {
log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l;
log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c;
unsigned int swath_height_l;
unsigned int swath_height_c;
if (!surf_vert) {
swath_height_l = rq_param->misc.rq_l.blk256_height;
swath_height_c = rq_param->misc.rq_c.blk256_height;
} else {
swath_height_l = rq_param->misc.rq_l.blk256_width;
swath_height_c = rq_param->misc.rq_c.blk256_width;
}
if (swath_height_l > 0)
log2_swath_height_l = dml_log2(swath_height_l);
if (req128_l && log2_swath_height_l > 0)
log2_swath_height_l -= 1;
if (swath_height_c > 0)
log2_swath_height_c = dml_log2(swath_height_c);
if (req128_c && log2_swath_height_c > 0)
log2_swath_height_c -= 1;
}
rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l;
rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c;

28
drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c
View File

@@ -344,13 +344,31 @@ static void handle_det_buf_split(
if (surf_linear) {
log2_swath_height_l = 0;
log2_swath_height_c = 0;
} else if (!surf_vert) {
log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l;
log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c;
} else {
log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l;
log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c;
unsigned int swath_height_l;
unsigned int swath_height_c;
if (!surf_vert) {
swath_height_l = rq_param->misc.rq_l.blk256_height;
swath_height_c = rq_param->misc.rq_c.blk256_height;
} else {
swath_height_l = rq_param->misc.rq_l.blk256_width;
swath_height_c = rq_param->misc.rq_c.blk256_width;
}
if (swath_height_l > 0)
log2_swath_height_l = dml_log2(swath_height_l);
if (req128_l && log2_swath_height_l > 0)
log2_swath_height_l -= 1;
if (swath_height_c > 0)
log2_swath_height_c = dml_log2(swath_height_c);
if (req128_c && log2_swath_height_c > 0)
log2_swath_height_c -= 1;
}
rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l;
rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c;