⬢ DragonFlyBSD Kernel Audit
DF-4450 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/i915/intel_psr.c
+++ b/sys/dev/drm/i915/intel_psr.c
@@ -456,6 +456,15 @@ static bool intel_psr2_config_valid(struct intel_dp *intel_dp,
 	if (!dev_priv->psr.sink_psr2_support)
 		return false;
 
+	/*
+	 * EDP_PSR2_CTL's IDLE_FRAME and FRAME_BEFORE_SU fields are only
+	 * 4 bits wide (i915_reg.h). A sink reporting the maximum resync
+	 * frame count (DP_MAX_RESYNC_FRAME_COUNT_MASK == 15) makes
+	 * hsw_activate_psr2() compute 15 + 1 = 16, which spills into the
+	 * adjacent FRAME_BEFORE_SU / TP2_TIME fields of the same register.
+	 * Refuse PSR2 instead of writing a corrupted encoding.
+	 */
+	if (dev_priv->psr.sink_sync_latency + 1 > EDP_PSR2_IDLE_FRAME_MASK)
+		return false;
+
 	if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv)) {
 		psr_max_h = 4096;
 		psr_max_v = 2304;