Re: [PATCH v2] drm/i915/dp: Use array size for intersect_rates() bound

On 8/5/2026 1:14 PM, Jani Nikula wrote:
> On Wed, 05 Aug 2026, "Borah, Chaitanya Kumar" <[email protected]> wrote:
>> On 8/4/2026 4:25 PM, Suraj Kandpal wrote:
>>> Take an explicit common_len parameter and pass
>>> ARRAY_SIZE(intel_dp->common_rates) at the call site, so the bound is
>>> tied to the destination array.
>>>
>>> Fixes: e6bda3e4cb43 ("drm/i915: Avoid overflowing the DP link rate arrays")
>>> Signed-off-by: Suraj Kandpal <[email protected]>
>>> ---
>>> v1 -> v2:
>>> -Use latest baseline (Jani)
>>>
>>>    drivers/gpu/drm/i915/display/intel_dp.c | 11 +++++++----
>>>    1 file changed, 7 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
>>> index 7f13595f40c1..1f1324c99130 100644
>>> --- a/drivers/gpu/drm/i915/display/intel_dp.c
>>> +++ b/drivers/gpu/drm/i915/display/intel_dp.c
>>> @@ -625,13 +625,13 @@ intel_dp_set_source_rates(struct intel_dp *intel_dp)
>>>    
>>>    static int intersect_rates(const int *source_rates, int source_len,
>>>    			   const int *sink_rates, int sink_len,
>>> -			   int *common_rates)
>>> +			   int *common_rates, int common_len)
>>>    {
>>>    	int i = 0, j = 0, k = 0;
>>>    
>>>    	while (i < source_len && j < sink_len) {
>>>    		if (source_rates[i] == sink_rates[j]) {
>>> -			if (WARN_ON(k >= DP_MAX_SUPPORTED_RATES))
>>> +			if (WARN_ON(k >= common_len))
>>
>> DP_MAX_SUPPORTED_RATES made more sense here because it keeps the size of
>> the common rate (and sink rate) from drifting away from the standard macro.
> 
> DP_MAX_SUPPORTED_RATES means the number of 16-bit rates to read from the
> eDP specific DP_SUPPORTED_LINK_RATES DPCD register. I think it's
> misleading to use it for *anything* else.
> 

I agree that this all is a bit fragile right now. We are overloading its 
meaning by using it in array sizes for sink_rates (in struct intel_dp) 
and common rates in intel_dp_set_common_link_params()

> The number of source and sink rates don't have to be linked in any way.
> 
> See intel_dp_set_source_rates(). All the platforms since ICL support 10
> or 11 rates i.e. more than DP_MAX_SUPPORTED_RATES.
>

True but the code still assumes (and ensures in a fragile way) that we 
will end up with at most DP_MAX_SUPPORTED_RATES number of common rates.
>>
>>>    				return k;
>>>    			common_rates[k] = source_rates[i];
>>>    			++k;
>>> @@ -660,6 +660,7 @@ int intel_dp_rate_index(const int *rates, int len, int rate)
>>>    
>>>    static void intel_dp_get_common_rates(struct intel_dp *intel_dp,
>>>    				      int common_rates[DP_MAX_SUPPORTED_RATES],
>>> +				      int common_len,
>>>    				      int *num_common_rates)
>>>    {
>>>    	struct intel_display *display = to_intel_display(intel_dp);
>>> @@ -671,7 +672,8 @@ static void intel_dp_get_common_rates(struct intel_dp *intel_dp,
>>>    					    intel_dp->num_source_rates,
>>>    					    intel_dp->sink_rates,
>>>    					    intel_dp->num_sink_rates,
>>> -					    common_rates);
>>> +					    common_rates,
>>> +					    common_len);
>>>    
>>>    	/* Paranoia, there should always be something in common. */
>>>    	if (drm_WARN_ON(display->drm, *num_common_rates == 0)) {
>>> @@ -687,7 +689,8 @@ static bool intel_dp_set_common_link_params(struct intel_dp *intel_dp)
>>>    	int common_rates[DP_MAX_SUPPORTED_RATES];
>>>    	bool params_changed = false;
>>>    
>>> -	intel_dp_get_common_rates(intel_dp, common_rates, &num_common_rates);
>>> +	intel_dp_get_common_rates(intel_dp, common_rates, ARRAY_SIZE(common_rates),
>>> +				  &num_common_rates);
>>
>> Is this patch in response to an actual bug or just a defensive code
>> change? If it is the later, does it add much value?
>>
>> common_rates and sink_rate are already locked in with
>> DP_MAX_SUPPORTED_RATES. There is a hazard of them drifting away from a
>> common size for which we could add a static enforcement of
>>
>> BUILD_BUG_ON(ARRAY_SIZE(common_rates) != ARRAY_SIZE(sink_rates));
>>
>> Something similar is done in intel_dp_set_dpcd_sink_rates() to keep the
>> sink_rate within limits.
>>
>> Regardless, if there is no actual bug then the Fixes tag is unjustified.
>>
>> ==
>>
>> Chaitanya
>>
>>
>>
>>>    	if (intel_dp_link_caps_update(intel_dp->link.caps,
>>>    				      common_rates, num_common_rates,
>>>    				      intel_dp_get_max_common_lane_count(intel_dp),
>>
>