drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
authorAlex Hung <alex.hung@amd.com>
Wed, 11 Jan 2023 16:54:11 +0000 (09:54 -0700)
committerAlex Deucher <alexander.deucher@amd.com>
Tue, 28 Feb 2023 19:29:35 +0000 (14:29 -0500)
[WHY]
When PTEBufferSizeInRequests is zero, UBSAN reports the following
warning because dml_log2 returns an unexpected negative value:

  shift exponent 4294966273 is too large for 32-bit type 'int'

[HOW]

In the case PTEBufferSizeInRequests is zero, skip the dml_log2() and
assign the result directly.

Reviewed-by: Jun Lei <Jun.Lei@amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c

index 379729b..c3d75e5 100644 (file)
@@ -1802,7 +1802,10 @@ static unsigned int CalculateVMAndRowBytes(
        }
 
        if (SurfaceTiling == dm_sw_linear) {
-               *dpte_row_height = dml_min(128, 1 << (unsigned int) dml_floor(dml_log2(PTEBufferSizeInRequests * *PixelPTEReqWidth / Pitch), 1));
+               if (PTEBufferSizeInRequests == 0)
+                       *dpte_row_height = 1;
+               else
+                       *dpte_row_height = dml_min(128, 1 << (unsigned int) dml_floor(dml_log2(PTEBufferSizeInRequests * *PixelPTEReqWidth / Pitch), 1));
                *dpte_row_width_ub = (dml_ceil(((double) SwathWidth - 1) / *PixelPTEReqWidth, 1) + 1) * *PixelPTEReqWidth;
                *PixelPTEBytesPerRow = *dpte_row_width_ub / *PixelPTEReqWidth * *PTERequestSize;
        } else if (ScanDirection != dm_vert) {