diff options
| author | Alex Hung <[email protected]> | 2024-05-31 11:51:26 -0600 |
|---|---|---|
| committer | Alex Deucher <[email protected]> | 2024-06-14 16:18:26 -0400 |
| commit | d6b54900c564e35989cf6813e4071504fa0a90e0 (patch) | |
| tree | a83a5dba93d54e9ab5c9b6c38c23143c9ecf60c5 | |
| parent | cc2b7387c132ebd51c7c5252cfcb494ac75ebf18 (diff) | |
drm/amd/display: Avoid overflow from uint32_t to uint8_t
[WHAT & HOW]
dmub_rb_cmd's ramping_boundary has size of uint8_t and it is assigned
0xFFFF. Fix it by changing it to uint8_t with value of 0xFF.
This fixes 2 INTEGER_OVERFLOW issues reported by Coverity.
Reviewed-by: Rodrigo Siqueira <[email protected]>
Acked-by: Zaeem Mohamed <[email protected]>
Signed-off-by: Alex Hung <[email protected]>
Tested-by: Daniel Wheeler <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
| -rw-r--r-- | drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c | 2 | ||||
| -rw-r--r-- | drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c index f4987e96fbf9..0d7e7f3b81a1 100644 --- a/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c +++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c @@ -258,7 +258,7 @@ bool dmub_abm_set_pipe(struct abm *abm, { union dmub_rb_cmd cmd; struct dc_context *dc = abm->ctx; - uint32_t ramping_boundary = 0xFFFF; + uint8_t ramping_boundary = 0xFF; memset(&cmd, 0, sizeof(cmd)); cmd.abm_set_pipe.header.type = DMUB_CMD__ABM; diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c index 804be977ea47..3de65a9f0e6f 100644 --- a/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c @@ -142,7 +142,7 @@ static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, { union dmub_rb_cmd cmd; struct dc_context *dc = abm->ctx; - uint32_t ramping_boundary = 0xFFFF; + uint8_t ramping_boundary = 0xFF; memset(&cmd, 0, sizeof(cmd)); cmd.abm_set_pipe.header.type = DMUB_CMD__ABM; |