drm/amd/display: Fix UBSAN: shift-out-of-bounds warning

[Why]
On NAVI14 CONFIG_UBSAN reported shift-out-of-bounds at
display_rq_dlg_calc_20v2.c:304:38

rq_param->misc.rq_c.blk256_height is 0 when chroma(*_c) is invalid.
dml_log2 returns -1023 for log2(0), although log2(0) is undefined.

Which ended up as:
rq_param->dlg.rq_c.swath_height = 1 << -1023

[How]
Fix applied on all dml versions.
1. Ensure dml_log2 is only called if the argument is greater than 0.
2. Subtract req128_l/req128_c from log2_swath_height_l/log2_swath_height_c
   only when it is greater than 0.

Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Anson Jacob <Anson.Jacob@amd.com>
Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
Reviewed-by: Jun Lei <Jun.Lei@amd.com>
Acked-by: Solomon Chiu <solomon.chiu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c
index 72423dc..799bae2 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20.c
@@ -293,13 +293,31 @@ static void handle_det_buf_split(struct display_mode_lib *mode_lib,
        if (surf_linear) {
                log2_swath_height_l = 0;
                log2_swath_height_c = 0;
-       } else if (!surf_vert) {
-               log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l;
-               log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c;
        } else {
-               log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l;
-               log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c;
+               unsigned int swath_height_l;
+               unsigned int swath_height_c;
+
+               if (!surf_vert) {
+                       swath_height_l = rq_param->misc.rq_l.blk256_height;
+                       swath_height_c = rq_param->misc.rq_c.blk256_height;
+               } else {
+                       swath_height_l = rq_param->misc.rq_l.blk256_width;
+                       swath_height_c = rq_param->misc.rq_c.blk256_width;
+               }
+
+               if (swath_height_l > 0)
+                       log2_swath_height_l = dml_log2(swath_height_l);
+
+               if (req128_l && log2_swath_height_l > 0)
+                       log2_swath_height_l -= 1;
+
+               if (swath_height_c > 0)
+                       log2_swath_height_c = dml_log2(swath_height_c);
+
+               if (req128_c && log2_swath_height_c > 0)
+                       log2_swath_height_c -= 1;
        }
+
        rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l;
        rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c;
 

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c
index 9c78446..6a6d597 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c
@@ -293,13 +293,31 @@ static void handle_det_buf_split(struct display_mode_lib *mode_lib,
        if (surf_linear) {
                log2_swath_height_l = 0;
                log2_swath_height_c = 0;
-       } else if (!surf_vert) {
-               log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l;
-               log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c;
        } else {
-               log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l;
-               log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c;
+               unsigned int swath_height_l;
+               unsigned int swath_height_c;
+
+               if (!surf_vert) {
+                       swath_height_l = rq_param->misc.rq_l.blk256_height;
+                       swath_height_c = rq_param->misc.rq_c.blk256_height;
+               } else {
+                       swath_height_l = rq_param->misc.rq_l.blk256_width;
+                       swath_height_c = rq_param->misc.rq_c.blk256_width;
+               }
+
+               if (swath_height_l > 0)
+                       log2_swath_height_l = dml_log2(swath_height_l);
+
+               if (req128_l && log2_swath_height_l > 0)
+                       log2_swath_height_l -= 1;
+
+               if (swath_height_c > 0)
+                       log2_swath_height_c = dml_log2(swath_height_c);
+
+               if (req128_c && log2_swath_height_c > 0)
+                       log2_swath_height_c -= 1;
        }
+
        rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l;
        rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c;
 

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c
index edd41d3..dc1c81a 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c
@@ -277,13 +277,31 @@ static void handle_det_buf_split(
        if (surf_linear) {
                log2_swath_height_l = 0;
                log2_swath_height_c = 0;
-       } else if (!surf_vert) {
-               log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l;
-               log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c;
        } else {
-               log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l;
-               log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c;
+               unsigned int swath_height_l;
+               unsigned int swath_height_c;
+
+               if (!surf_vert) {
+                       swath_height_l = rq_param->misc.rq_l.blk256_height;
+                       swath_height_c = rq_param->misc.rq_c.blk256_height;
+               } else {
+                       swath_height_l = rq_param->misc.rq_l.blk256_width;
+                       swath_height_c = rq_param->misc.rq_c.blk256_width;
+               }
+
+               if (swath_height_l > 0)
+                       log2_swath_height_l = dml_log2(swath_height_l);
+
+               if (req128_l && log2_swath_height_l > 0)
+                       log2_swath_height_l -= 1;
+
+               if (swath_height_c > 0)
+                       log2_swath_height_c = dml_log2(swath_height_c);
+
+               if (req128_c && log2_swath_height_c > 0)
+                       log2_swath_height_c -= 1;
        }
+
        rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l;
        rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c;
 

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_rq_dlg_calc_30.c b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_rq_dlg_calc_30.c
index 0f14f20..04601a7 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_rq_dlg_calc_30.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn30/display_rq_dlg_calc_30.c
@@ -237,13 +237,31 @@ static void handle_det_buf_split(struct display_mode_lib *mode_lib,
        if (surf_linear) {
                log2_swath_height_l = 0;
                log2_swath_height_c = 0;
-       } else if (!surf_vert) {
-               log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l;
-               log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c;
        } else {
-               log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l;
-               log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c;
+               unsigned int swath_height_l;
+               unsigned int swath_height_c;
+
+               if (!surf_vert) {
+                       swath_height_l = rq_param->misc.rq_l.blk256_height;
+                       swath_height_c = rq_param->misc.rq_c.blk256_height;
+               } else {
+                       swath_height_l = rq_param->misc.rq_l.blk256_width;
+                       swath_height_c = rq_param->misc.rq_c.blk256_width;
+               }
+
+               if (swath_height_l > 0)
+                       log2_swath_height_l = dml_log2(swath_height_l);
+
+               if (req128_l && log2_swath_height_l > 0)
+                       log2_swath_height_l -= 1;
+
+               if (swath_height_c > 0)
+                       log2_swath_height_c = dml_log2(swath_height_c);
+
+               if (req128_c && log2_swath_height_c > 0)
+                       log2_swath_height_c -= 1;
        }
+
        rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l;
        rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c;
 

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c
index 4c3e9cc..414da64 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dml1_display_rq_dlg_calc.c
@@ -344,13 +344,31 @@ static void handle_det_buf_split(
        if (surf_linear) {
                log2_swath_height_l = 0;
                log2_swath_height_c = 0;
-       } else if (!surf_vert) {
-               log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_height) - req128_l;
-               log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_height) - req128_c;
        } else {
-               log2_swath_height_l = dml_log2(rq_param->misc.rq_l.blk256_width) - req128_l;
-               log2_swath_height_c = dml_log2(rq_param->misc.rq_c.blk256_width) - req128_c;
+               unsigned int swath_height_l;
+               unsigned int swath_height_c;
+
+               if (!surf_vert) {
+                       swath_height_l = rq_param->misc.rq_l.blk256_height;
+                       swath_height_c = rq_param->misc.rq_c.blk256_height;
+               } else {
+                       swath_height_l = rq_param->misc.rq_l.blk256_width;
+                       swath_height_c = rq_param->misc.rq_c.blk256_width;
+               }
+
+               if (swath_height_l > 0)
+                       log2_swath_height_l = dml_log2(swath_height_l);
+
+               if (req128_l && log2_swath_height_l > 0)
+                       log2_swath_height_l -= 1;
+
+               if (swath_height_c > 0)
+                       log2_swath_height_c = dml_log2(swath_height_c);
+
+               if (req128_c && log2_swath_height_c > 0)
+                       log2_swath_height_c -= 1;
        }
+
        rq_param->dlg.rq_l.swath_height = 1 << log2_swath_height_l;
        rq_param->dlg.rq_c.swath_height = 1 << log2_swath_height_c;