From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Date: Thu, 23 Apr 2026 13:32:10 +0000 (+0530)
Subject: drm/amd/display: Fix unsigned underflow in SubVP vblank schedulability check v2
X-Git-Tag: v7.2-rc1~141^2~24^2~112
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=437cbca5ea50af4d1b37dd05aa33b4e791fd6d0f;p=thirdparty%2Flinux.git

drm/amd/display: Fix unsigned underflow in SubVP vblank schedulability check v2

subvp_vblank_schedulable() checks whether the SubVP active region can
fit the prefetch time, vblank frame time, and the larger of the vblank
blanking time and MALL region.

Commit 11236ac905e7 ("drm/amd/display: Fix dml2_0 narrowing boundaries")
changed the intermediate timing variables from u16 to u32. After that
change, the schedulability test:

	subvp_active_us - prefetch_us - vblank_frame_us -
	max_vblank_mallregion > 0

is evaluated in unsigned arithmetic. If the required time exceeds the
available active time, the subtraction can underflow and wrap, producing
a large positive value instead of a negative result.

Fix this by comparing the available time against the required time
directly, using u64 for the accumulated required duration.

v2:
- Use uint64_t instead of u64 for consistency with DC style (Dillon)
- Make all terms explicitly uint64_t in the accumulated sum & use
  single-definition form for required_us (Gaghik)

Fixes: 11236ac905e7 ("drm/amd/display: Fix dml2_0 narrowing boundaries")
Reported-by: Dan Carpenter <error27@gmail.com>
Cc: Roman Li <roman.li@amd.com>
Cc: Alex Hung <alex.hung@amd.com>
Cc: Tom Chung <chiahsuan.chung@amd.com>
Cc: Dillon Varone <dillon.varone@amd.com>
Cc: Gaghik Khachatrian <gaghik.khachatrian@amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Cc: Chenyu Chen <chen-yu.chen@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---

diff --git a/drivers/gpu/drm/amd/display/dc/dml2_0/dml2_mall_phantom.c b/drivers/gpu/drm/amd/display/dc/dml2_0/dml2_mall_phantom.c
index fe667aea6ec85..4543a60a06839 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2_0/dml2_mall_phantom.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2_0/dml2_mall_phantom.c
@@ -594,11 +594,14 @@ static bool subvp_vblank_schedulable(struct dml2_context *ctx, struct dc_state *
 		subvp_active_us = (uint32_t)(main_timing->v_addressable * main_timing->h_total /
 				(double)(main_timing->pix_clk_100hz * 100) * 1000000);
 		max_vblank_mallregion = vblank_blank_us > mall_region_us ? vblank_blank_us : mall_region_us;
+		const uint64_t required_us = (uint64_t)prefetch_us +
+					     (uint64_t)vblank_frame_us +
+					     (uint64_t)max_vblank_mallregion;
 
 		// Schedulable if VACTIVE region of the SubVP pipe can fit the MALL prefetch, VBLANK frame time,
 		// and the max of (VBLANK blanking time, MALL region)
 		// TODO: Possibly add some margin (i.e. the below conditions should be [...] > X instead of [...] > 0)
-		if (subvp_active_us - prefetch_us - vblank_frame_us - max_vblank_mallregion > 0)
+		if ((uint64_t)subvp_active_us > required_us)
 			schedulable = true;
 	}
 	return schedulable;