From nobody Mon Jun 8 11:02:09 2026 Received: from exchange.fintech.ru (exchange.fintech.ru [195.54.195.159]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5639B3612EE for ; Fri, 29 May 2026 14:58:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=195.54.195.159 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780066688; cv=none; b=C5vgAK6F7LdP9+HDRglCs9cDeD4tco257ms5HQbOINZeO8iZiMhl9cKDUgdQiDFbQemgPj+2HmtShgRRzsNxnXlQMyotGV3Vy80bamPgcBUO7Z7xoCoHuNmsrW/qxnzJ10IEIkSugelh7mF+DNTpdcmpnRU6LNAWBdmojhSEuao= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780066688; c=relaxed/simple; bh=szD+nh3axkxUxeksmQ1Gp43BuCKHjeBdshZGJy8JfDY=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=kTnLOPV6opLa3gaHbPpfsnoIbWTdAn2jeIQnC91/1kc8dQ40GWyQuyvoQ3tROK7C7uofPtJh8ramsnnNvcAK9DwBpCjXWKlN6UUgz45y6u7YOWkqmsuPLpUQSokRPV62899bxVhcuKO26g2A9qjQ5AfoeO3aOuZwCxAjkqSedOY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=fintech.ru; spf=pass smtp.mailfrom=fintech.ru; arc=none smtp.client-ip=195.54.195.159 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=fintech.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=fintech.ru Received: from Ex16-01.fintech.ru (10.0.10.18) by exchange.fintech.ru (195.54.195.169) with Microsoft SMTP Server (TLS) id 14.3.498.0; Fri, 29 May 2026 17:58:03 +0300 Received: from localhost (10.0.253.153) by Ex16-01.fintech.ru (10.0.10.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.4; Fri, 29 May 2026 17:58:02 +0300 From: Nikita Zhandarovich To: Jani Nikula , Rodrigo Vivi , Joonas Lahtinen CC: Nikita Zhandarovich , Tvrtko Ursulin , David Airlie , Simona Vetter , , , , , Subject: [PATCH v2] drm/i915/edp: Check supported link rates DPCD read Date: Fri, 29 May 2026 17:57:58 +0300 Message-ID: <20260529145759.1640646-1-n.zhandarovich@fintech.ru> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: Ex16-02.fintech.ru (10.0.10.19) To Ex16-01.fintech.ru (10.0.10.18) Content-Type: text/plain; charset="utf-8" intel_edp_set_sink_rates() reads DP_SUPPORTED_LINK_RATES into a local stack array and then parses the array unconditionally. If the read fails, the array contents are not valid and may result in bogus sink link rates being used. Use drm_dp_dpcd_read_data() and clear the sink rate array on failure, so the existing parser falls back to the default sink rate handling. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: 68f357cb7347 ("drm/i915/dp: generate and cache sink rate array for a= ll DP, not just eDP 1.4") Signed-off-by: Nikita Zhandarovich Reviewed-by: Jani Nikula --- v1 -> v2: - Use drm_dp_dpcd_read_data() instead of drm_dp_dpcd_read(). - Avoid the goto by clearing sink_rates on read failure, as suggested by Jani Nikula. - Adjust patch description. drivers/gpu/drm/i915/display/intel_dp.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915= /display/intel_dp.c index 6ef2a0043cda..5c3e816b0135 100644 --- a/drivers/gpu/drm/i915/display/intel_dp.c +++ b/drivers/gpu/drm/i915/display/intel_dp.c @@ -4678,10 +4678,17 @@ intel_edp_set_sink_rates(struct intel_dp *intel_dp) =20 if (intel_dp->edp_dpcd[0] >=3D DP_EDP_14) { __le16 sink_rates[DP_MAX_SUPPORTED_RATES]; + int ret; int i; =20 - drm_dp_dpcd_read(&intel_dp->aux, DP_SUPPORTED_LINK_RATES, - sink_rates, sizeof(sink_rates)); + ret =3D drm_dp_dpcd_read_data(&intel_dp->aux, + DP_SUPPORTED_LINK_RATES, + sink_rates, sizeof(sink_rates)); + if (ret < 0) { + drm_dbg_kms(display->drm, + "Unable to read eDP supported link rates, using default rates\n"); + memset(sink_rates, 0, sizeof(sink_rates)); + } =20 for (i =3D 0; i < ARRAY_SIZE(sink_rates); i++) { int rate;