From: Alex Hung <alex.hung@amd.com>
Date: Fri, 31 May 2024 11:51:26 -0600
Subject: [PATCH] drm/amd/display: Avoid overflow from uint32_t to uint8_t
Git-commit: d6b54900c564e35989cf6813e4071504fa0a90e0
Patch-mainline: v6.11-rc1
References: CVE-2024-47661 bsc#1231496
 
[ Dropped hunk in drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c ]
 
[WHAT & HOW]
dmub_rb_cmd's ramping_boundary has size of uint8_t and it is assigned
0xFFFF. Fix it by changing it to uint8_t with value of 0xFF.
 
This fixes 2 INTEGER_OVERFLOW issues reported by Coverity.
 
Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
Acked-by: Zaeem Mohamed <zaeem.mohamed@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: David Sterba <dsterba@suse.com>
---
 drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 
--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c
@@ -141,7 +141,7 @@ static bool dmub_abm_set_pipe(struct abm
 {
 	union dmub_rb_cmd cmd;
 	struct dc_context *dc = abm->ctx;
-	uint32_t ramping_boundary = 0xFFFF;
+	uint8_t ramping_boundary = 0xFF;
 
 	memset(&cmd, 0, sizeof(cmd));
 	cmd.abm_set_pipe.header.type = DMUB_CMD__ABM;