The calc_allowed_config_filter() function passes the return value of
iter_pos_to_idx() directly to BIT(), but the helper can return -1 for
an invalid iterator.
The iterator already rejects negative indices before doing a
configuration, so this should not matter in normal flows. In any
case, for robustness, check the index explicitly and warn if it is
negative, avoiding an undefined shift.
Fixes: 39e30bdf2f92 ("drm/i915/dp_link_caps: Add link configuration iterator")
Signed-off-by: Luca Coelho <[email protected]>
---
drivers/gpu/drm/i915/display/intel_dp_link_caps.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/display/intel_dp_link_caps.c
b/drivers/gpu/drm/i915/display/intel_dp_link_caps.c
index 7b6cc6055da8..98657aa4d3d5 100644
--- a/drivers/gpu/drm/i915/display/intel_dp_link_caps.c
+++ b/drivers/gpu/drm/i915/display/intel_dp_link_caps.c
@@ -426,12 +426,15 @@ calc_allowed_config_filter(struct intel_dp_link_caps
*link_caps,
const struct intel_dp_link_config *forced_params)
{
struct intel_dp_link_caps_filter allowed_configs =
INTEL_DP_LINK_CAPS_FILTER_NONE;
+ struct intel_display *display = to_intel_display(link_caps->dp);
struct intel_dp_link_caps_order order = bw_desc_config_order();
struct intel_dp_link_caps_iter iter;
struct intel_dp_link_config config;
iter_start(&iter, link_caps, order, enabled_configs);
for_each_dp_link_config(&iter, &config) {
+ int config_idx;
+
if (forced_params->rate &&
forced_params->rate != config.rate)
continue;
@@ -446,7 +449,11 @@ calc_allowed_config_filter(struct intel_dp_link_caps
*link_caps,
if (config.lane_count > max_limits->lane_count)
continue;
- allowed_configs.config_mask |= BIT(iter_pos_to_idx(link_caps,
order, iter.pos));
+ config_idx = iter_pos_to_idx(link_caps, order, iter.pos);
+ if (drm_WARN_ON(display->drm, config_idx < 0))
+ continue;
+
+ allowed_configs.config_mask |= BIT(config_idx);
}
intel_dp_link_caps_iter_end(&iter);
--
2.53.0
