From patchwork Thu Sep 19 14:36:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikita Zhandarovich X-Patchwork-Id: 13807794 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 94387CF3945 for ; Thu, 19 Sep 2024 14:36:18 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id E505110E714; Thu, 19 Sep 2024 14:36:17 +0000 (UTC) Received: from exchange.fintech.ru (exchange.fintech.ru [195.54.195.159]) by gabe.freedesktop.org (Postfix) with ESMTPS id 8306010E714; Thu, 19 Sep 2024 14:36:16 +0000 (UTC) Received: from Ex16-01.fintech.ru (10.0.10.18) by exchange.fintech.ru (195.54.195.159) with Microsoft SMTP Server (TLS) id 14.3.498.0; Thu, 19 Sep 2024 17:36:15 +0300 Received: from localhost (10.0.253.138) by Ex16-01.fintech.ru (10.0.10.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.4; Thu, 19 Sep 2024 17:36:14 +0300 From: Nikita Zhandarovich To: , Greg Kroah-Hartman CC: Nikita Zhandarovich , Jani Nikula , Rodrigo Vivi , "Joonas Lahtinen" , Tvrtko Ursulin , David Airlie , , , , , , Jani Nikula Subject: [PATCH 5.10/5.15 1/1] drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll() Date: Thu, 19 Sep 2024 07:36:07 -0700 Message-ID: <20240919143607.14178-2-n.zhandarovich@fintech.ru> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20240919143607.14178-1-n.zhandarovich@fintech.ru> References: <20240919143607.14178-1-n.zhandarovich@fintech.ru> MIME-Version: 1.0 X-Originating-IP: [10.0.253.138] X-ClientProxiedBy: Ex16-02.fintech.ru (10.0.10.19) To Ex16-01.fintech.ru (10.0.10.18) X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" From: Nikita Zhandarovich commit 5b511572660190db1dc8ba412efd0be0d3781ab6 upstream. On the off chance that clock value ends up being too high (by means of skl_ddi_calculate_wrpll() having been called with big enough value of crtc_state->port_clock * 1000), one possible consequence may be that the result will not be able to fit into signed int. Fix this issue by moving conversion of clock parameter from kHz to Hz into the body of skl_ddi_calculate_wrpll(), as well as casting the same parameter to u64 type while calculating the value for AFE clock. This both mitigates the overflow problem and avoids possible erroneous integer promotion mishaps. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: 82d354370189 ("drm/i915/skl: Implementation of SKL DPLL programming") Signed-off-by: Nikita Zhandarovich Reviewed-by: Jani Nikula Signed-off-by: Jani Nikula [Nikita: This patch had to be cherry-picked due to function skl_ddi_calculate_wrpll() having had bool return value instead of an int one in 5.15 and earlier kernel versions.] Signed-off-by: Nikita Zhandarovich --- drivers/gpu/drm/i915/display/intel_dpll_mgr.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/display/intel_dpll_mgr.c b/drivers/gpu/drm/i915/display/intel_dpll_mgr.c index 91b37b76618d..40c392b7ce75 100644 --- a/drivers/gpu/drm/i915/display/intel_dpll_mgr.c +++ b/drivers/gpu/drm/i915/display/intel_dpll_mgr.c @@ -1465,11 +1465,11 @@ static void skl_wrpll_params_populate(struct skl_wrpll_params *params, } static bool -skl_ddi_calculate_wrpll(int clock /* in Hz */, +skl_ddi_calculate_wrpll(int clock, int ref_clock, struct skl_wrpll_params *wrpll_params) { - u64 afe_clock = clock * 5; /* AFE Clock is 5x Pixel clock */ + u64 afe_clock = (u64)clock * 1000 * 5; /* AFE Clock is 5x Pixel clock, in HZ */ u64 dco_central_freq[3] = { 8400000000ULL, 9000000000ULL, 9600000000ULL }; @@ -1552,7 +1552,7 @@ static bool skl_ddi_hdmi_pll_dividers(struct intel_crtc_state *crtc_state) ctrl1 |= DPLL_CTRL1_HDMI_MODE(0); - if (!skl_ddi_calculate_wrpll(crtc_state->port_clock * 1000, + if (!skl_ddi_calculate_wrpll(crtc_state->port_clock, i915->dpll.ref_clks.nssc, &wrpll_params)) return false;