From: Luca Coelho Date: Tue, 20 May 2025 08:26:58 +0000 (+0300) Subject: drm/i915/dkl: return if tc_port is invalid in dkl_phy_set_hip_idx() X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c206a27eb72f13d345d51818152e8707d4563b51;p=thirdparty%2Flinux.git drm/i915/dkl: return if tc_port is invalid in dkl_phy_set_hip_idx() In dkl_phy_set_hip_idx(), we may try to shift a value negatively, whose behavior is undefined. This can happen because we define TC_PORT_NONE to -1, so theoretically tc_port could be -1. We will then use tc_port to shift to the correct address of the specified port, but if it's negative, anything can happen. If this happens or tc_port exceeds I915_MAX_TC_PORTS, it's safer to return with a warning than risk an invalid write. Signed-off-by: Luca Coelho Reviewed-by: Mika Kahola Signed-off-by: Mika Kahola Link: https://lore.kernel.org/r/20250520082917.1302665-2-luciano.coelho@intel.com --- diff --git a/drivers/gpu/drm/i915/display/intel_dkl_phy.c b/drivers/gpu/drm/i915/display/intel_dkl_phy.c index dad7192132ad9..35e919eae3691 100644 --- a/drivers/gpu/drm/i915/display/intel_dkl_phy.c +++ b/drivers/gpu/drm/i915/display/intel_dkl_phy.c @@ -25,7 +25,9 @@ dkl_phy_set_hip_idx(struct intel_display *display, struct intel_dkl_phy_reg reg) { enum tc_port tc_port = DKL_REG_TC_PORT(reg); - drm_WARN_ON(display->drm, tc_port < TC_PORT_1 || tc_port >= I915_MAX_TC_PORTS); + if (drm_WARN_ON(display->drm, + tc_port < TC_PORT_1 || tc_port >= I915_MAX_TC_PORTS)) + return; intel_de_write(display, HIP_INDEX_REG(tc_port),