From 1961dfcadcad0de1e592b58be24c0cf41338e392 Mon Sep 17 00:00:00 2001 From: Alex Hung Date: Fri, 18 Oct 2024 19:12:09 +0800 Subject: [PATCH] drm/amd/display: Avoid overflow from uint32_t to uint8_t MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mainline inclusion from mainline-v6.11-rc1 commit d6b54900c564e35989cf6813e4071504fa0a90e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU7X CVE: CVE-2024-47661 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6b54900c564e35989cf6813e4071504fa0a90e0 -------------------------------- [WHAT & HOW] dmub_rb_cmd's ramping_boundary has size of uint8_t and it is assigned 0xFFFF. Fix it by changing it to uint8_t with value of 0xFF. This fixes 2 INTEGER_OVERFLOW issues reported by Coverity. Reviewed-by: Rodrigo Siqueira Acked-by: Zaeem Mohamed Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Conflicts: drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c [ Not backport e53524cdcc02d(“drm/amd/display: Refactor HWSS into component folder”), conflict due to file renaming. ] Signed-off-by: Li Huafei --- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c index c766666a3160..9d18562a218f 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c @@ -141,7 +141,7 @@ static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t optio { union dmub_rb_cmd cmd; struct dc_context *dc = abm->ctx; - uint32_t ramping_boundary = 0xFFFF; + uint8_t ramping_boundary = 0xFF; cmd.abm_set_pipe.header.type = DMUB_CMD__ABM; cmd.abm_set_pipe.header.sub_type = DMUB_CMD__ABM_SET_PIPE; -- Gitee