On Fri, 29 May 2026, Nikita Zhandarovich <[email protected]> wrote:
> intel_edp_set_sink_rates() reads DP_SUPPORTED_LINK_RATES into a local
> stack array and then parses the array unconditionally. If the read
> fails or returns less data than requested, the array contents are not
> valid and may result in bogus sink link rates being used.
>
> Check that the full DPCD block was read before parsing it. If not, fall
> back to the default sink rate handling.
>
> Found by Linux Verification Center (linuxtesting.org) with static
> analysis tool SVACE.
Thanks for the patch.
>
> Fixes: 68f357cb7347 ("drm/i915/dp: generate and cache sink rate array for all
> DP, not just eDP 1.4")
> Signed-off-by: Nikita Zhandarovich <[email protected]>
> ---
> drivers/gpu/drm/i915/display/intel_dp.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/display/intel_dp.c
> b/drivers/gpu/drm/i915/display/intel_dp.c
> index 6ef2a0043cda..b6650a12ca54 100644
> --- a/drivers/gpu/drm/i915/display/intel_dp.c
> +++ b/drivers/gpu/drm/i915/display/intel_dp.c
> @@ -4678,10 +4678,16 @@ intel_edp_set_sink_rates(struct intel_dp *intel_dp)
>
> if (intel_dp->edp_dpcd[0] >= DP_EDP_14) {
> __le16 sink_rates[DP_MAX_SUPPORTED_RATES];
> + ssize_t ret;
> int i;
>
> - drm_dp_dpcd_read(&intel_dp->aux, DP_SUPPORTED_LINK_RATES,
> - sink_rates, sizeof(sink_rates));
> + ret = drm_dp_dpcd_read(&intel_dp->aux, DP_SUPPORTED_LINK_RATES,
> + sink_rates, sizeof(sink_rates));
Please switch to drm_dp_dpcd_read_data(). It'll return < 0 for errors,
and is easier to deal with.
> + if (ret != sizeof(sink_rates)) {
> + drm_dbg_kms(display->drm,
> + "Unable to read eDP supported link rates,
> using default rates\n");
> + goto use_default_rates;
I think I'd avoid the goto and use:
memset(sink_rates, 0, sizeof(sink_rates));
BR,
Jani.
> + }
>
> for (i = 0; i < ARRAY_SIZE(sink_rates); i++) {
> int rate;
> @@ -4715,6 +4721,7 @@ intel_edp_set_sink_rates(struct intel_dp *intel_dp)
> * Use DP_LINK_RATE_SET if DP_SUPPORTED_LINK_RATES are available,
> * default to DP_MAX_LINK_RATE and DP_LINK_BW_SET otherwise.
> */
> +use_default_rates:
> if (intel_dp->num_sink_rates)
> intel_dp->use_rate_select = true;
> else
--
Jani Nikula, Intel
