From 31a804733bec41bef96a54b36a04735e8fb05cfb Mon Sep 17 00:00:00 2001 From: jsg Date: Tue, 28 Mar 2023 04:09:34 +0000 Subject: [PATCH] drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes From Alex Hung a16394b5d661afec9a264fecac3abd87aea439ea in linux-6.1.y/6.1.21 031f196d1b1b6d5dfcb0533b431e3ab1750e6189 in mainline linux --- .../pci/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sys/dev/pci/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c b/sys/dev/pci/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c index cc11696e4ce..1e9b157cfe8 100644 --- a/sys/dev/pci/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c +++ b/sys/dev/pci/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c @@ -1804,7 +1804,10 @@ static unsigned int CalculateVMAndRowBytes( } if (SurfaceTiling == dm_sw_linear) { - *dpte_row_height = dml_min(128, 1 << (unsigned int) dml_floor(dml_log2(PTEBufferSizeInRequests * *PixelPTEReqWidth / Pitch), 1)); + if (PTEBufferSizeInRequests == 0) + *dpte_row_height = 1; + else + *dpte_row_height = dml_min(128, 1 << (unsigned int) dml_floor(dml_log2(PTEBufferSizeInRequests * *PixelPTEReqWidth / Pitch), 1)); *dpte_row_width_ub = (dml_ceil(((double) SwathWidth - 1) / *PixelPTEReqWidth, 1) + 1) * *PixelPTEReqWidth; *PixelPTEBytesPerRow = *dpte_row_width_ub / *PixelPTEReqWidth * *PTERequestSize; } else if (ScanDirection != dm_vert) { -- 2.20.1