From: jsg <jsg@openbsd.org>
Date: Tue, 28 Mar 2023 04:09:34 +0000 (+0000)
Subject: drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=31a804733bec41bef96a54b36a04735e8fb05cfb;p=openbsd

drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes

From Alex Hung
a16394b5d661afec9a264fecac3abd87aea439ea in linux-6.1.y/6.1.21
031f196d1b1b6d5dfcb0533b431e3ab1750e6189 in mainline linux
---

diff --git a/sys/dev/pci/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c b/sys/dev/pci/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
index cc11696e4ce..1e9b157cfe8 100644
--- a/sys/dev/pci/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
+++ b/sys/dev/pci/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c
@@ -1804,7 +1804,10 @@ static unsigned int CalculateVMAndRowBytes(
 	}
 
 	if (SurfaceTiling == dm_sw_linear) {
-		*dpte_row_height = dml_min(128, 1 << (unsigned int) dml_floor(dml_log2(PTEBufferSizeInRequests * *PixelPTEReqWidth / Pitch), 1));
+		if (PTEBufferSizeInRequests == 0)
+			*dpte_row_height = 1;
+		else
+			*dpte_row_height = dml_min(128, 1 << (unsigned int) dml_floor(dml_log2(PTEBufferSizeInRequests * *PixelPTEReqWidth / Pitch), 1));
 		*dpte_row_width_ub = (dml_ceil(((double) SwathWidth - 1) / *PixelPTEReqWidth, 1) + 1) * *PixelPTEReqWidth;
 		*PixelPTEBytesPerRow = *dpte_row_width_ub / *PixelPTEReqWidth * *PTERequestSize;
 	} else if (ScanDirection != dm_vert) {