On Wed, 05 Aug 2026, "Borah, Chaitanya Kumar" <[email protected]>
wrote:
> On 8/4/2026 4:25 PM, Suraj Kandpal wrote:
>> Take an explicit common_len parameter and pass
>> ARRAY_SIZE(intel_dp->common_rates) at the call site, so the bound is
>> tied to the destination array.
>>
>> Fixes: e6bda3e4cb43 ("drm/i915: Avoid overflowing the DP link rate arrays")
>> Signed-off-by: Suraj Kandpal <[email protected]>
>> ---
>> v1 -> v2:
>> -Use latest baseline (Jani)
>>
>> drivers/gpu/drm/i915/display/intel_dp.c | 11 +++++++----
>> 1 file changed, 7 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/i915/display/intel_dp.c
>> b/drivers/gpu/drm/i915/display/intel_dp.c
>> index 7f13595f40c1..1f1324c99130 100644
>> --- a/drivers/gpu/drm/i915/display/intel_dp.c
>> +++ b/drivers/gpu/drm/i915/display/intel_dp.c
>> @@ -625,13 +625,13 @@ intel_dp_set_source_rates(struct intel_dp *intel_dp)
>>
>> static int intersect_rates(const int *source_rates, int source_len,
>> const int *sink_rates, int sink_len,
>> - int *common_rates)
>> + int *common_rates, int common_len)
>> {
>> int i = 0, j = 0, k = 0;
>>
>> while (i < source_len && j < sink_len) {
>> if (source_rates[i] == sink_rates[j]) {
>> - if (WARN_ON(k >= DP_MAX_SUPPORTED_RATES))
>> + if (WARN_ON(k >= common_len))
>
> DP_MAX_SUPPORTED_RATES made more sense here because it keeps the size of
> the common rate (and sink rate) from drifting away from the standard macro.
DP_MAX_SUPPORTED_RATES means the number of 16-bit rates to read from the
eDP specific DP_SUPPORTED_LINK_RATES DPCD register. I think it's
misleading to use it for *anything* else.
The number of source and sink rates don't have to be linked in any way.
See intel_dp_set_source_rates(). All the platforms since ICL support 10
or 11 rates i.e. more than DP_MAX_SUPPORTED_RATES.
>
>> return k;
>> common_rates[k] = source_rates[i];
>> ++k;
>> @@ -660,6 +660,7 @@ int intel_dp_rate_index(const int *rates, int len, int
>> rate)
>>
>> static void intel_dp_get_common_rates(struct intel_dp *intel_dp,
>> int common_rates[DP_MAX_SUPPORTED_RATES],
>> + int common_len,
>> int *num_common_rates)
>> {
>> struct intel_display *display = to_intel_display(intel_dp);
>> @@ -671,7 +672,8 @@ static void intel_dp_get_common_rates(struct intel_dp
>> *intel_dp,
>> intel_dp->num_source_rates,
>> intel_dp->sink_rates,
>> intel_dp->num_sink_rates,
>> - common_rates);
>> + common_rates,
>> + common_len);
>>
>> /* Paranoia, there should always be something in common. */
>> if (drm_WARN_ON(display->drm, *num_common_rates == 0)) {
>> @@ -687,7 +689,8 @@ static bool intel_dp_set_common_link_params(struct
>> intel_dp *intel_dp)
>> int common_rates[DP_MAX_SUPPORTED_RATES];
>> bool params_changed = false;
>>
>> - intel_dp_get_common_rates(intel_dp, common_rates, &num_common_rates);
>> + intel_dp_get_common_rates(intel_dp, common_rates,
>> ARRAY_SIZE(common_rates),
>> + &num_common_rates);
>
> Is this patch in response to an actual bug or just a defensive code
> change? If it is the later, does it add much value?
>
> common_rates and sink_rate are already locked in with
> DP_MAX_SUPPORTED_RATES. There is a hazard of them drifting away from a
> common size for which we could add a static enforcement of
>
> BUILD_BUG_ON(ARRAY_SIZE(common_rates) != ARRAY_SIZE(sink_rates));
>
> Something similar is done in intel_dp_set_dpcd_sink_rates() to keep the
> sink_rate within limits.
>
> Regardless, if there is no actual bug then the Fixes tag is unjustified.
>
> ==
>
> Chaitanya
>
>
>
>> if (intel_dp_link_caps_update(intel_dp->link.caps,
>> common_rates, num_common_rates,
>>
>> intel_dp_get_max_common_lane_count(intel_dp),
>
--
Jani Nikula, Intel
