From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3518A31077A for ; Fri, 29 May 2026 15:17:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.15 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780067822; cv=none; b=XPw7NmkuCkvIhpnpoYJV+zDkc+iyW6tQPMyn2sJO1TAoSGmLzDybIdt2ZmXYGb8/5QDZF5nmAuldWMeGmPpMC/mhno4Ww0aZzKcV8yxCOgbwgseb0cmKDkRJyhS9lSgwuBVyxuW31MaA7PfzqD0XoG05rFMKxkkp1E28CLWjneI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780067822; c=relaxed/simple; bh=HedptQ/6CIwjp4YiEkdapvOi2Wo7J+jtmUPcqWAfNeo=; h=From:To:Cc:Subject:In-Reply-To:References:Date:Message-ID: MIME-Version:Content-Type; b=LIge5Hb7TEEUPbhUArrL2M7suItRbbhX1f+ppfwQQ7g6RXqsxEqnWtTYo7VOiyJo7XN+jjWXzD+WqshnhRujp6yXiYvj/dgKHKoRsEvjAuwn1e591CklaNoe4+TM1YMjNeob0D6OUY8opRsn/uZz4d4LZ8qkLtZ7aaOBR4zzuQc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=d4BnL2ZA; arc=none smtp.client-ip=192.198.163.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="d4BnL2ZA" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1780067821; x=1811603821; h=from:to:cc:subject:in-reply-to:references:date: message-id:mime-version; bh=HedptQ/6CIwjp4YiEkdapvOi2Wo7J+jtmUPcqWAfNeo=; b=d4BnL2ZAP+jOJH05R1LO7iNxVNr6P6wNwa67n4lq2It3oO7BSWUdyiUp GjPMwAKRXyPfF9xvWGYMAgUqXtiffzc+Mq53QkSkO8/L3g3rOic/UG2hy HK+M53mbkiYUJ53nQgvedDLcbeGFwEaKsVD8AXzB0/Ao0CFIz2ToOWlQz pxKZywlVT42o5zuT19BO9xWCoIezjSdX9Sc80LNar473AaN37btPeEigz IEkCZKFDKKzm5kJaaYmTLhSvIEvpYFpFwR9tYGQpZZjRxFpTCq3rYsE+O A2oiKeGS9O4JvFvElAXtWNty7kwQ7Gy1fqpP7nZD3PZMs+UHNeqS6GDON Q==; X-CSE-ConnectionGUID: lyfWGmXxQsm38z7prrj5Bw== X-CSE-MsgGUID: QbiztDKdR0+5O5TImpPnaQ== X-IronPort-AV: E=McAfee;i="6800,10657,11801"; a="81035502" X-IronPort-AV: E=Sophos;i="6.24,175,1774335600"; d="scan'208";a="81035502" Received: from orviesa002.jf.intel.com ([10.64.159.142]) by fmvoesa109.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 May 2026 08:17:00 -0700 X-CSE-ConnectionGUID: i6bFdGVTS82BuB4IRgzZTA== X-CSE-MsgGUID: CaBophDrRayP69jpuH6lKw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.24,175,1774335600"; d="scan'208";a="273187289" Received: from kniemiec-mobl1.ger.corp.intel.com (HELO localhost) ([10.245.244.147]) by orviesa002-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 May 2026 08:16:57 -0700 From: Jani Nikula To: Nikita Zhandarovich , Rodrigo Vivi , Joonas Lahtinen Cc: Nikita Zhandarovich , Tvrtko Ursulin , David Airlie , Simona Vetter , intel-gfx@lists.freedesktop.org, intel-xe@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org Subject: Re: [PATCH v2] drm/i915/edp: Check supported link rates DPCD read In-Reply-To: <20260529145759.1640646-1-n.zhandarovich@fintech.ru> Organization: Intel Finland Oy - BIC 0357606-4 - c/o Alberga Business Park, 6 krs Bertel Jungin Aukio 5, 02600 Espoo, Finland References: <20260529145759.1640646-1-n.zhandarovich@fintech.ru> Date: Fri, 29 May 2026 18:16:54 +0300 Message-ID: <824c6ced1095635f86527709822c8af3ddff7c8c@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain On Fri, 29 May 2026, Nikita Zhandarovich wrote: > intel_edp_set_sink_rates() reads DP_SUPPORTED_LINK_RATES into a local > stack array and then parses the array unconditionally. If the read > fails, the array contents are not valid and may result in bogus sink > link rates being used. > > Use drm_dp_dpcd_read_data() and clear the sink rate array on failure, > so the existing parser falls back to the default sink rate handling. > > Found by Linux Verification Center (linuxtesting.org) with static > analysis tool SVACE. > > Fixes: 68f357cb7347 ("drm/i915/dp: generate and cache sink rate array for all DP, not just eDP 1.4") > Signed-off-by: Nikita Zhandarovich Reviewed-by: Jani Nikula > --- > v1 -> v2: > - Use drm_dp_dpcd_read_data() instead of drm_dp_dpcd_read(). > - Avoid the goto by clearing sink_rates on read failure, as suggested by > Jani Nikula. > - Adjust patch description. > > drivers/gpu/drm/i915/display/intel_dp.c | 11 +++++++++-- > 1 file changed, 9 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c > index 6ef2a0043cda..5c3e816b0135 100644 > --- a/drivers/gpu/drm/i915/display/intel_dp.c > +++ b/drivers/gpu/drm/i915/display/intel_dp.c > @@ -4678,10 +4678,17 @@ intel_edp_set_sink_rates(struct intel_dp *intel_dp) > > if (intel_dp->edp_dpcd[0] >= DP_EDP_14) { > __le16 sink_rates[DP_MAX_SUPPORTED_RATES]; > + int ret; > int i; > > - drm_dp_dpcd_read(&intel_dp->aux, DP_SUPPORTED_LINK_RATES, > - sink_rates, sizeof(sink_rates)); > + ret = drm_dp_dpcd_read_data(&intel_dp->aux, > + DP_SUPPORTED_LINK_RATES, > + sink_rates, sizeof(sink_rates)); > + if (ret < 0) { > + drm_dbg_kms(display->drm, > + "Unable to read eDP supported link rates, using default rates\n"); > + memset(sink_rates, 0, sizeof(sink_rates)); > + } > > for (i = 0; i < ARRAY_SIZE(sink_rates); i++) { > int rate; -- Jani Nikula, Intel