From patchwork Thu Feb 10 10:36:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Jani Nikula X-Patchwork-Id: 541729 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1722BC433F5 for ; Thu, 10 Feb 2022 10:36:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239748AbiBJKg4 (ORCPT ); Thu, 10 Feb 2022 05:36:56 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:49978 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236331AbiBJKgz (ORCPT ); Thu, 10 Feb 2022 05:36:55 -0500 Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3E4E4CEF for ; Thu, 10 Feb 2022 02:36:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1644489417; x=1676025417; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=/MCVdcbKEx9AmIG3UIRzYnARUah4jBgqHNLR1qrQo28=; b=Hd15JJ3OfKv8Mcs86UyUwfAEbYC1VLERON4+h+TzpfLoZbum8On23DnL BZC0v9iz5s73Yl5EOQ+MxQu7bmLFxgixwUi4kII5miRe7KfVXzGaskWRq pTRiwB2J6abRAN7E/Ubet4Ht+20Q1SLE6wJZg4qcFoivqp8NH9DfYZvyt 7wxK7ZehnYJWWga1rMY//2WRK5y1W9qxkp7AYCBWX4uqWIui4ZmakFCBS Jaq17gvlwBL90XPvZuQEeFwfd4Vpd+8oSzkBUM06mJHT2FETmQnE519Lt LdF2JJ46RtAcnsTj4uR7/ZTJjssnBhQUZuGhQ0Ms1oSWwmdtt2C4hpL4W w==; X-IronPort-AV: E=McAfee;i="6200,9189,10253"; a="249669507" X-IronPort-AV: E=Sophos;i="5.88,358,1635231600"; d="scan'208";a="249669507" Received: from orsmga007.jf.intel.com ([10.7.209.58]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Feb 2022 02:36:56 -0800 X-IronPort-AV: E=Sophos;i="5.88,358,1635231600"; d="scan'208";a="526429203" Received: from dhogarty-mobl1.ger.corp.intel.com (HELO localhost) ([10.252.10.221]) by orsmga007-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Feb 2022 02:36:54 -0800 From: Jani Nikula To: intel-gfx@lists.freedesktop.org Cc: jani.nikula@intel.com, stable@vger.kernel.org, =?utf-8?b?VmlsbGUgU3ly?= =?utf-8?b?asOkbMOk?= , Lucas De Marchi Subject: [PATCH 1/5] drm/i915/opregion: check port number bounds for SWSCI display power state Date: Thu, 10 Feb 2022 12:36:42 +0200 Message-Id: X-Mailer: git-send-email 2.30.2 In-Reply-To: References: MIME-Version: 1.0 Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org The mapping from enum port to whatever port numbering scheme is used by the SWSCI Display Power State Notification is odd, and the memory of it has faded. In any case, the parameter only has space for ports numbered [0..4], and UBSAN reports bit shift beyond it when the platform has port F or more. Since the SWSCI functionality is supposed to be obsolete for new platforms (i.e. ones that might have port F or more), just bail out early if the mapped and mangled port number is beyond what the Display Power State Notification can support. Fixes: 9c4b0a683193 ("drm/i915: add opregion function to notify bios of encoder enable/disable") Cc: # v3.13+ Cc: Ville Syrjälä Cc: Lucas De Marchi Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/4800 Signed-off-by: Jani Nikula --- drivers/gpu/drm/i915/display/intel_opregion.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/gpu/drm/i915/display/intel_opregion.c b/drivers/gpu/drm/i915/display/intel_opregion.c index af9d30f56cc1..ad1afe9df6c3 100644 --- a/drivers/gpu/drm/i915/display/intel_opregion.c +++ b/drivers/gpu/drm/i915/display/intel_opregion.c @@ -363,6 +363,21 @@ int intel_opregion_notify_encoder(struct intel_encoder *intel_encoder, port++; } + /* + * The port numbering and mapping here is bizarre. The now-obsolete + * swsci spec supports ports numbered [0..4]. Port E is handled as a + * special case, but port F and beyond are not. The functionality is + * supposed to be obsolete for new platforms. Just bail out if the port + * number is out of bounds after mapping. + */ + if (port > 4) { + drm_dbg_kms(&dev_priv->drm, + "[ENCODER:%d:%s] port %c (index %u) out of bounds for display power state notification\n", + intel_encoder->base.base.id, intel_encoder->base.name, + port_name(intel_encoder->port), port); + return -EINVAL; + } + if (!enable) parm |= 4 << 8;