⬢ DragonFlyBSD Kernel Audit
DF-4621 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -154,7 +154,8 @@
 	uint8_t param_index = 0;
 	long param[2];
 	const char delimiter[3] = {' ', '\n', '\0'};
-	bool valid_input = false;
+	bool valid_lane_count = false;
+	bool valid_link_rate = false;
 
 	if (size == 0)
 		return -EINVAL;
@@ -196,7 +197,7 @@
 	case LANE_COUNT_ONE:
 	case LANE_COUNT_TWO:
 	case LANE_COUNT_FOUR:
-		valid_input = true;
+		valid_lane_count = true;
 		break;
 	default:
 		break;
@@ -208,13 +209,19 @@
 	case LINK_RATE_RBR2:
 	case LINK_RATE_HIGH2:
 	case LINK_RATE_HIGH3:
-		valid_input = true;
+		valid_link_rate = true;
 		break;
 	default:
 		break;
 	}
 
-	if (!valid_input) {
+	/* NB: both parameters must validate; the previous single OR-combined
+	 * flag accepted an invalid lane_count whenever the link_rate parsed
+	 * (and vice versa), and the unchecked lane_count later drives the
+	 * lane_settings[LANE_COUNT_DP_MAX] write loop in
+	 * dp_phy_settings_write plus dc decide_link_settings().
+	 */
+	if (!valid_lane_count || !valid_link_rate) {
 		kfree(wr_buf);
 		DRM_DEBUG_DRIVER("Invalid Input value No HW will be programmed\n");
 		return bytes_from_user;