drm/amd/display: Avoid overflow assignment in link_dp_cts

[ Upstream commit a15268787b79fd183dd526cc16bec9af4f4e49a1 ]

sampling_rate is an uint8_t but is assigned an unsigned int, and thus it
can overflow. As a result, sampling_rate is changed to uint32_t.

Similarly, LINK_QUAL_PATTERN_SET has a size of 2 bits, and it should
only be assigned to a value less or equal than 4.

This fixes 2 INTEGER_OVERFLOW issues reported by Coverity.

Signed-off-by: Alex Hung <alex.hung@amd.com>
Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h
index 519c3df78ee5b263d5e6d131623c2888a248988c..95c275bf649bdc020fbab675b4a8af3e4b495269 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h
@@ -727,7 +727,7 @@ struct dp_audio_test_data_flags {
 struct dp_audio_test_data {
 
        struct dp_audio_test_data_flags flags;
-       uint8_t sampling_rate;
+       uint32_t sampling_rate;
        uint8_t channel_count;
        uint8_t pattern_type;
        uint8_t pattern_period[8];

diff --git a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
index 8d1a1cc94a8b372ffe2918558cf817c6a9023f55..6b27ac56f60d8ac00bb7d78a843bc1828bf503e5 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
+++ b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
@@ -775,7 +775,8 @@ bool dp_set_test_pattern(
                        core_link_read_dpcd(link, DP_TRAINING_PATTERN_SET,
                                            &training_pattern.raw,
                                            sizeof(training_pattern));
-                       training_pattern.v1_3.LINK_QUAL_PATTERN_SET = pattern;
+                       if (pattern <= PHY_TEST_PATTERN_END_DP11)
+                               training_pattern.v1_3.LINK_QUAL_PATTERN_SET = pattern;
                        core_link_write_dpcd(link, DP_TRAINING_PATTERN_SET,
                                             &training_pattern.raw,
                                             sizeof(training_pattern));

diff --git a/drivers/gpu/drm/amd/display/include/dpcd_defs.h b/drivers/gpu/drm/amd/display/include/dpcd_defs.h
index aee5170f5fb231a045613f7dbb038df39d39c859..c246235e4afec4145701024a8fa4a63b093f5bb9 100644 (file)
--- a/drivers/gpu/drm/amd/display/include/dpcd_defs.h
+++ b/drivers/gpu/drm/amd/display/include/dpcd_defs.h
@@ -76,6 +76,7 @@ enum dpcd_phy_test_patterns {
        PHY_TEST_PATTERN_D10_2,
        PHY_TEST_PATTERN_SYMBOL_ERROR,
        PHY_TEST_PATTERN_PRBS7,
+       PHY_TEST_PATTERN_END_DP11 = PHY_TEST_PATTERN_PRBS7,
        PHY_TEST_PATTERN_80BIT_CUSTOM,/* For DP1.2 only */
        PHY_TEST_PATTERN_CP2520_1,
        PHY_TEST_PATTERN_CP2520_2,