Re: [PATCH] drm/i915/dp: Use array size for intersect_rates() bound

On Tue, 04 Aug 2026, Suraj Kandpal <[email protected]> wrote:
> Take an explicit common_len parameter and pass
> ARRAY_SIZE(intel_dp->common_rates) at the call site, so the bound is
> tied to the destination array.
>
> Fixes: e6bda3e4cb43 ("drm/i915: Avoid overflowing the DP link rate arrays")
> Signed-off-by: Suraj Kandpal <[email protected]>
> ---
>  drivers/gpu/drm/i915/display/intel_dp.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
> index 7f13595f40c1..dd0fbb0ba20d 100644
> --- a/drivers/gpu/drm/i915/display/intel_dp.c
> +++ b/drivers/gpu/drm/i915/display/intel_dp.c
> @@ -625,13 +625,13 @@ intel_dp_set_source_rates(struct intel_dp *intel_dp)
>  
>  static int intersect_rates(const int *source_rates, int source_len,
>  			   const int *sink_rates, int sink_len,
> -			   int *common_rates)
> +			   int *common_rates, int common_len)
>  {
>  	int i = 0, j = 0, k = 0;
>  
>  	while (i < source_len && j < sink_len) {
>  		if (source_rates[i] == sink_rates[j]) {
> -			if (WARN_ON(k >= DP_MAX_SUPPORTED_RATES))
> +			if (WARN_ON(k >= common_len))
>  				return k;
>  			common_rates[k] = source_rates[i];
>  			++k;
> @@ -671,7 +671,8 @@ static void intel_dp_get_common_rates(struct intel_dp *intel_dp,
>  					    intel_dp->num_source_rates,
>  					    intel_dp->sink_rates,
>  					    intel_dp->num_sink_rates,
> -					    common_rates);
> +					    intel_dp->common_rates,
> +					    ARRAY_SIZE(intel_dp->common_rates));

This is using some old baseline.

BR,
Jani.

>  
>  	/* Paranoia, there should always be something in common. */
>  	if (drm_WARN_ON(display->drm, *num_common_rates == 0)) {

-- 
Jani Nikula, Intel