[PATCH] drm/i915/pfit: Prevent negative coordinates in center mode

[PATCH] drm/i915/pfit: Prevent negative coordinates in center mode

[Nemesa Garg]

When the pipe_src width or height are greater than adjusted_mode hdisplay
and vdisplay, computed x and y offsets for center mode can be negative.
Writing negative values into the pch_fit registers result in a state error.
Add a check to clamp these values so that they are never negative.

Signed-off-by: Nemesa Garg <nemesa.garg@intel.com>
---
 drivers/gpu/drm/i915/display/intel_pfit.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_pfit.c b/drivers/gpu/drm/i915/display/intel_pfit.c
index 6dda496190e0..1507c2b5b5c7 100644
--- a/drivers/gpu/drm/i915/display/intel_pfit.c
+++ b/drivers/gpu/drm/i915/display/intel_pfit.c
@@ -186,6 +186,7 @@ static int pch_panel_fitting(struct intel_crtc_state *crtc_state,
 			     const struct drm_connector_state *conn_state)
 {
 	struct intel_display *display = to_intel_display(crtc_state);
+	struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc);
 	const struct drm_display_mode *adjusted_mode =
 		&crtc_state->hw.adjusted_mode;
 	int pipe_src_w = drm_rect_width(&crtc_state->pipe_src);
@@ -204,6 +205,16 @@ static int pch_panel_fitting(struct intel_crtc_state *crtc_state,
 		height = pipe_src_h;
 		x = (adjusted_mode->crtc_hdisplay - width + 1)/2;
 		y = (adjusted_mode->crtc_vdisplay - height + 1)/2;
+		if (adjusted_mode->crtc_hdisplay < width ||
+		    adjusted_mode->crtc_vdisplay < height) {
+			drm_dbg_kms(display->drm,
+				    "[CRTC:%d:%s] pfit center mode source (%dx%d) exceeds display (%dx%d)\n",
+				    crtc->base.base.id, crtc->base.name,
+				    width, height,
+				    adjusted_mode->crtc_hdisplay,
+				    adjusted_mode->crtc_vdisplay);
+			return -EINVAL;
+		}
 		break;
 
 	case DRM_MODE_SCALE_ASPECT:
-- 
2.25.1

Re: [PATCH] drm/i915/pfit: Prevent negative coordinates in center mode

[Ville Syrjälä]

On Tue, Mar 31, 2026 at 11:10:44PM +0530, Nemesa Garg wrote:
> When the pipe_src width or height are greater than adjusted_mode hdisplay
> and vdisplay, computed x and y offsets for center mode can be negative.
> Writing negative values into the pch_fit registers result in a state error.
> Add a check to clamp these values so that they are never negative.
> 
> Signed-off-by: Nemesa Garg <nemesa.garg@intel.com>
> ---
>  drivers/gpu/drm/i915/display/intel_pfit.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/gpu/drm/i915/display/intel_pfit.c b/drivers/gpu/drm/i915/display/intel_pfit.c
> index 6dda496190e0..1507c2b5b5c7 100644
> --- a/drivers/gpu/drm/i915/display/intel_pfit.c
> +++ b/drivers/gpu/drm/i915/display/intel_pfit.c
> @@ -186,6 +186,7 @@ static int pch_panel_fitting(struct intel_crtc_state *crtc_state,
>  			     const struct drm_connector_state *conn_state)
>  {
>  	struct intel_display *display = to_intel_display(crtc_state);
> +	struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc);
>  	const struct drm_display_mode *adjusted_mode =
>  		&crtc_state->hw.adjusted_mode;
>  	int pipe_src_w = drm_rect_width(&crtc_state->pipe_src);
> @@ -204,6 +205,16 @@ static int pch_panel_fitting(struct intel_crtc_state *crtc_state,
>  		height = pipe_src_h;
>  		x = (adjusted_mode->crtc_hdisplay - width + 1)/2;
>  		y = (adjusted_mode->crtc_vdisplay - height + 1)/2;
> +		if (adjusted_mode->crtc_hdisplay < width ||
> +		    adjusted_mode->crtc_vdisplay < height) {
> +			drm_dbg_kms(display->drm,
> +				    "[CRTC:%d:%s] pfit center mode source (%dx%d) exceeds display (%dx%d)\n",
> +				    crtc->base.base.id, crtc->base.name,
> +				    width, height,

width,height represent the pfit output window size. So I think it'd
be better to do the check in terms of pipe_src_w,pipe_src_h.

And I guess then we can do it before we even compute x,y,width,height.

> +				    adjusted_mode->crtc_hdisplay,
> +				    adjusted_mode->crtc_vdisplay);
> +			return -EINVAL;
> +		}
>  		break;
>  
>  	case DRM_MODE_SCALE_ASPECT:
> -- 
> 2.25.1

-- 
Ville Syrjälä
Intel

RE: [PATCH] drm/i915/pfit: Prevent negative coordinates in center mode

[Garg, Nemesa]

> -----Original Message-----
> From: Ville Syrjälä <ville.syrjala@linux.intel.com>
> Sent: Tuesday, March 31, 2026 11:32 PM
> To: Garg, Nemesa <nemesa.garg@intel.com>
> Cc: intel-gfx@lists.freedesktop.org; intel-xe@lists.freedesktop.org
> Subject: Re: [PATCH] drm/i915/pfit: Prevent negative coordinates in center
> mode
> 
> On Tue, Mar 31, 2026 at 11:10:44PM +0530, Nemesa Garg wrote:
> > When the pipe_src width or height are greater than adjusted_mode
> > hdisplay and vdisplay, computed x and y offsets for center mode can be
> negative.
> > Writing negative values into the pch_fit registers result in a state error.
> > Add a check to clamp these values so that they are never negative.
> >
> > Signed-off-by: Nemesa Garg <nemesa.garg@intel.com>
> > ---
> >  drivers/gpu/drm/i915/display/intel_pfit.c | 11 +++++++++++
> >  1 file changed, 11 insertions(+)
> >
> > diff --git a/drivers/gpu/drm/i915/display/intel_pfit.c
> > b/drivers/gpu/drm/i915/display/intel_pfit.c
> > index 6dda496190e0..1507c2b5b5c7 100644
> > --- a/drivers/gpu/drm/i915/display/intel_pfit.c
> > +++ b/drivers/gpu/drm/i915/display/intel_pfit.c
> > @@ -186,6 +186,7 @@ static int pch_panel_fitting(struct intel_crtc_state
> *crtc_state,
> >  			     const struct drm_connector_state *conn_state)  {
> >  	struct intel_display *display = to_intel_display(crtc_state);
> > +	struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc);
> >  	const struct drm_display_mode *adjusted_mode =
> >  		&crtc_state->hw.adjusted_mode;
> >  	int pipe_src_w = drm_rect_width(&crtc_state->pipe_src);
> > @@ -204,6 +205,16 @@ static int pch_panel_fitting(struct intel_crtc_state
> *crtc_state,
> >  		height = pipe_src_h;
> >  		x = (adjusted_mode->crtc_hdisplay - width + 1)/2;
> >  		y = (adjusted_mode->crtc_vdisplay - height + 1)/2;
> > +		if (adjusted_mode->crtc_hdisplay < width ||
> > +		    adjusted_mode->crtc_vdisplay < height) {
> > +			drm_dbg_kms(display->drm,
> > +				    "[CRTC:%d:%s] pfit center mode source
> (%dx%d) exceeds display (%dx%d)\n",
> > +				    crtc->base.base.id, crtc->base.name,
> > +				    width, height,
> 
> width,height represent the pfit output window size. So I think it'd be better to
> do the check in terms of pipe_src_w,pipe_src_h.
> 
> And I guess then we can do it before we even compute x,y,width,height.
> 
Sure. Will change.

Thanks and Regards,
Nemesa
> > +				    adjusted_mode->crtc_hdisplay,
> > +				    adjusted_mode->crtc_vdisplay);
> > +			return -EINVAL;
> > +		}
> >  		break;
> >
> >  	case DRM_MODE_SCALE_ASPECT:
> > --
> > 2.25.1
> 
> --
> Ville Syrjälä
> Intel

✓ i915.CI.BAT: success for drm/i915/pfit: Prevent negative coordinates in center mode

[Patchwork]

[-- Attachment #1: Type: text/plain, Size: 5712 bytes --]

== Series Details ==

Series: drm/i915/pfit: Prevent negative coordinates in center mode
URL   : https://patchwork.freedesktop.org/series/164188/
State : success

== Summary ==

CI Bug Log - changes from CI_DRM_18256 -> Patchwork_164188v1
====================================================

Summary
-------

  **SUCCESS**

  No regressions found.

  External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/index.html

Participating hosts (41 -> 40)
------------------------------

  Additional (1): bat-adls-6 
  Missing    (2): bat-dg2-13 fi-snb-2520m 

Known issues
------------

  Here are the changes found in Patchwork_164188v1 that come from known issues:

### IGT changes ###

#### Issues hit ####

  * igt@dmabuf@all-tests@dma_fence_chain:
    - fi-skl-6600u:       NOTRUN -> [SKIP][1]
   [1]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/fi-skl-6600u/igt@dmabuf@all-tests@dma_fence_chain.html

  * igt@gem_lmem_swapping@parallel-random-engines:
    - bat-adls-6:         NOTRUN -> [SKIP][2] ([i915#4613]) +3 other tests skip
   [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/bat-adls-6/igt@gem_lmem_swapping@parallel-random-engines.html

  * igt@gem_tiled_pread_basic@basic:
    - bat-adls-6:         NOTRUN -> [SKIP][3] ([i915#15656])
   [3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/bat-adls-6/igt@gem_tiled_pread_basic@basic.html

  * igt@intel_hwmon@hwmon-read:
    - bat-adls-6:         NOTRUN -> [SKIP][4] ([i915#7707]) +1 other test skip
   [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/bat-adls-6/igt@intel_hwmon@hwmon-read.html

  * igt@kms_cursor_legacy@basic-busy-flip-before-cursor-legacy:
    - bat-adls-6:         NOTRUN -> [SKIP][5] ([i915#4103]) +1 other test skip
   [5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/bat-adls-6/igt@kms_cursor_legacy@basic-busy-flip-before-cursor-legacy.html

  * igt@kms_dsc@dsc-basic:
    - bat-adls-6:         NOTRUN -> [SKIP][6] ([i915#3555] / [i915#3840])
   [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/bat-adls-6/igt@kms_dsc@dsc-basic.html

  * igt@kms_force_connector_basic@force-load-detect:
    - bat-adls-6:         NOTRUN -> [SKIP][7]
   [7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/bat-adls-6/igt@kms_force_connector_basic@force-load-detect.html

  * igt@kms_pm_backlight@basic-brightness:
    - bat-adls-6:         NOTRUN -> [SKIP][8] ([i915#5354])
   [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/bat-adls-6/igt@kms_pm_backlight@basic-brightness.html

  * igt@kms_psr@psr-primary-mmap-gtt:
    - bat-adls-6:         NOTRUN -> [SKIP][9] ([i915#1072] / [i915#9732]) +3 other tests skip
   [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/bat-adls-6/igt@kms_psr@psr-primary-mmap-gtt.html

  * igt@kms_setmode@basic-clone-single-crtc:
    - bat-adls-6:         NOTRUN -> [SKIP][10] ([i915#3555])
   [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/bat-adls-6/igt@kms_setmode@basic-clone-single-crtc.html

  * igt@prime_vgem@basic-fence-read:
    - bat-adls-6:         NOTRUN -> [SKIP][11] ([i915#3291]) +2 other tests skip
   [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/bat-adls-6/igt@prime_vgem@basic-fence-read.html

  
#### Possible fixes ####

  * igt@i915_selftest@live:
    - fi-skl-6600u:       [INCOMPLETE][12] ([i915#15859]) -> [PASS][13]
   [12]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_18256/fi-skl-6600u/igt@i915_selftest@live.html
   [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/fi-skl-6600u/igt@i915_selftest@live.html

  * igt@i915_selftest@live@gem_contexts:
    - fi-skl-6600u:       [INCOMPLETE][14] -> [PASS][15]
   [14]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_18256/fi-skl-6600u/igt@i915_selftest@live@gem_contexts.html
   [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/fi-skl-6600u/igt@i915_selftest@live@gem_contexts.html

  * igt@i915_selftest@live@workarounds:
    - bat-dg2-9:          [DMESG-FAIL][16] ([i915#12061]) -> [PASS][17] +1 other test pass
   [16]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_18256/bat-dg2-9/igt@i915_selftest@live@workarounds.html
   [17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/bat-dg2-9/igt@i915_selftest@live@workarounds.html

  
  [i915#1072]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/1072
  [i915#12061]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12061
  [i915#15656]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15656
  [i915#15859]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15859
  [i915#3291]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/3291
  [i915#3555]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/3555
  [i915#3840]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/3840
  [i915#4103]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/4103
  [i915#4613]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/4613
  [i915#5354]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/5354
  [i915#7707]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/7707
  [i915#9732]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/9732


Build changes
-------------

  * Linux: CI_DRM_18256 -> Patchwork_164188v1

  CI-20190529: 20190529
  CI_DRM_18256: 779129c7868f4c7205901d6e57b25de52b411d1c @ git://anongit.freedesktop.org/gfx-ci/linux
  IGT_8839: 8839
  Patchwork_164188v1: 779129c7868f4c7205901d6e57b25de52b411d1c @ git://anongit.freedesktop.org/gfx-ci/linux

== Logs ==

For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164188v1/index.html

[-- Attachment #2: Type: text/html, Size: 6745 bytes --]

[PATCH] drm/i915/pfit: Prevent negative coordinates in center mode

[Nemesa Garg]

When the pipe_src width or height are greater than adjusted_mode hdisplay
and vdisplay, computed x and y offsets for center mode can be negative.
Writing negative values into the pch_fit registers result in a state error.
Add a check to clamp these values so that they are never negative.

v2: Compare in terms of pipe_src width and height.[Ville]

Signed-off-by: Nemesa Garg <nemesa.garg@intel.com>
---
 drivers/gpu/drm/i915/display/intel_pfit.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_pfit.c b/drivers/gpu/drm/i915/display/intel_pfit.c
index 6dda496190e0..0edd29eef6ad 100644
--- a/drivers/gpu/drm/i915/display/intel_pfit.c
+++ b/drivers/gpu/drm/i915/display/intel_pfit.c
@@ -186,6 +186,7 @@ static int pch_panel_fitting(struct intel_crtc_state *crtc_state,
 			     const struct drm_connector_state *conn_state)
 {
 	struct intel_display *display = to_intel_display(crtc_state);
+	struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc);
 	const struct drm_display_mode *adjusted_mode =
 		&crtc_state->hw.adjusted_mode;
 	int pipe_src_w = drm_rect_width(&crtc_state->pipe_src);
@@ -200,6 +201,16 @@ static int pch_panel_fitting(struct intel_crtc_state *crtc_state,
 
 	switch (conn_state->scaling_mode) {
 	case DRM_MODE_SCALE_CENTER:
+		if (adjusted_mode->crtc_hdisplay < pipe_src_w ||
+		    adjusted_mode->crtc_vdisplay < pipe_src_h) {
+			drm_dbg_kms(display->drm,
+				    "[CRTC:%d:%s] pfit center mode source (%dx%d) exceeds display (%dx%d)\n",
+				    crtc->base.base.id, crtc->base.name,
+				    width, height,
+				    adjusted_mode->crtc_hdisplay,
+				    adjusted_mode->crtc_vdisplay);
+			return -EINVAL;
+		}
 		width = pipe_src_w;
 		height = pipe_src_h;
 		x = (adjusted_mode->crtc_hdisplay - width + 1)/2;
-- 
2.25.1

Re: [PATCH] drm/i915/pfit: Prevent negative coordinates in center mode

[Ville Syrjälä]

On Tue, Mar 31, 2026 at 11:46:56PM +0530, Nemesa Garg wrote:
> When the pipe_src width or height are greater than adjusted_mode hdisplay
> and vdisplay, computed x and y offsets for center mode can be negative.
> Writing negative values into the pch_fit registers result in a state error.
> Add a check to clamp these values so that they are never negative.
> 
> v2: Compare in terms of pipe_src width and height.[Ville]
> 
> Signed-off-by: Nemesa Garg <nemesa.garg@intel.com>
> ---
>  drivers/gpu/drm/i915/display/intel_pfit.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/gpu/drm/i915/display/intel_pfit.c b/drivers/gpu/drm/i915/display/intel_pfit.c
> index 6dda496190e0..0edd29eef6ad 100644
> --- a/drivers/gpu/drm/i915/display/intel_pfit.c
> +++ b/drivers/gpu/drm/i915/display/intel_pfit.c
> @@ -186,6 +186,7 @@ static int pch_panel_fitting(struct intel_crtc_state *crtc_state,
>  			     const struct drm_connector_state *conn_state)
>  {
>  	struct intel_display *display = to_intel_display(crtc_state);
> +	struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc);
>  	const struct drm_display_mode *adjusted_mode =
>  		&crtc_state->hw.adjusted_mode;
>  	int pipe_src_w = drm_rect_width(&crtc_state->pipe_src);
> @@ -200,6 +201,16 @@ static int pch_panel_fitting(struct intel_crtc_state *crtc_state,
>  
>  	switch (conn_state->scaling_mode) {
>  	case DRM_MODE_SCALE_CENTER:
> +		if (adjusted_mode->crtc_hdisplay < pipe_src_w ||
> +		    adjusted_mode->crtc_vdisplay < pipe_src_h) {
> +			drm_dbg_kms(display->drm,
> +				    "[CRTC:%d:%s] pfit center mode source (%dx%d) exceeds display (%dx%d)\n",
> +				    crtc->base.base.id, crtc->base.name,
> +				    width, height,

These should should be pipe_src_* as well.

> +				    adjusted_mode->crtc_hdisplay,
> +				    adjusted_mode->crtc_vdisplay);
> +			return -EINVAL;
> +		}
>  		width = pipe_src_w;
>  		height = pipe_src_h;
>  		x = (adjusted_mode->crtc_hdisplay - width + 1)/2;
> -- 
> 2.25.1

-- 
Ville Syrjälä
Intel

Re: [PATCH] drm/i915/pfit: Prevent negative coordinates in center mode

[kernel test robot]

Hi Nemesa,

kernel test robot noticed the following build warnings:

[auto build test WARNING on drm-i915/for-linux-next]
[also build test WARNING on drm-i915/for-linux-next-fixes drm-tip/drm-tip linus/master v7.0-rc6 next-20260401]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Nemesa-Garg/drm-i915-pfit-Prevent-negative-coordinates-in-center-mode/20260403-100828
base:   https://gitlab.freedesktop.org/drm/i915/kernel.git for-linux-next
patch link:    https://lore.kernel.org/r/20260331181656.77300-1-nemesa.garg%40intel.com
patch subject: [PATCH] drm/i915/pfit: Prevent negative coordinates in center mode
config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20260403/202604032320.Bmwm7fST-lkp@intel.com/config)
compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260403/202604032320.Bmwm7fST-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604032320.Bmwm7fST-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> drivers/gpu/drm/i915/display/intel_pfit.c:209:9: warning: variable 'width' is uninitialized when used here [-Wuninitialized]
     209 |                                     width, height,
         |                                     ^~~~~
   include/drm/drm_print.h:653:52: note: expanded from macro 'drm_dbg_kms'
     653 |         drm_dev_dbg(__drm_to_dev(drm), DRM_UT_KMS, fmt, ##__VA_ARGS__)
         |                                                           ^~~~~~~~~~~
   include/drm/drm_print.h:563:39: note: expanded from macro 'drm_dev_dbg'
     563 |         __drm_dev_dbg(NULL, dev, cat, fmt, ##__VA_ARGS__)
         |                                              ^~~~~~~~~~~
   drivers/gpu/drm/i915/display/intel_pfit.c:194:22: note: initialize the variable 'width' to silence this warning
     194 |         int ret, x, y, width, height;
         |                             ^
         |                              = 0
>> drivers/gpu/drm/i915/display/intel_pfit.c:209:16: warning: variable 'height' is uninitialized when used here [-Wuninitialized]
     209 |                                     width, height,
         |                                            ^~~~~~
   include/drm/drm_print.h:653:52: note: expanded from macro 'drm_dbg_kms'
     653 |         drm_dev_dbg(__drm_to_dev(drm), DRM_UT_KMS, fmt, ##__VA_ARGS__)
         |                                                           ^~~~~~~~~~~
   include/drm/drm_print.h:563:39: note: expanded from macro 'drm_dev_dbg'
     563 |         __drm_dev_dbg(NULL, dev, cat, fmt, ##__VA_ARGS__)
         |                                              ^~~~~~~~~~~
   drivers/gpu/drm/i915/display/intel_pfit.c:194:30: note: initialize the variable 'height' to silence this warning
     194 |         int ret, x, y, width, height;
         |                                     ^
         |                                      = 0
   2 warnings generated.


vim +/width +209 drivers/gpu/drm/i915/display/intel_pfit.c

   183	
   184	/* adjusted_mode has been preset to be the panel's fixed mode */
   185	static int pch_panel_fitting(struct intel_crtc_state *crtc_state,
   186				     const struct drm_connector_state *conn_state)
   187	{
   188		struct intel_display *display = to_intel_display(crtc_state);
   189		struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc);
   190		const struct drm_display_mode *adjusted_mode =
   191			&crtc_state->hw.adjusted_mode;
   192		int pipe_src_w = drm_rect_width(&crtc_state->pipe_src);
   193		int pipe_src_h = drm_rect_height(&crtc_state->pipe_src);
   194		int ret, x, y, width, height;
   195	
   196		/* Native modes don't need fitting */
   197		if (adjusted_mode->crtc_hdisplay == pipe_src_w &&
   198		    adjusted_mode->crtc_vdisplay == pipe_src_h &&
   199		    crtc_state->output_format != INTEL_OUTPUT_FORMAT_YCBCR420)
   200			return 0;
   201	
   202		switch (conn_state->scaling_mode) {
   203		case DRM_MODE_SCALE_CENTER:
   204			if (adjusted_mode->crtc_hdisplay < pipe_src_w ||
   205			    adjusted_mode->crtc_vdisplay < pipe_src_h) {
   206				drm_dbg_kms(display->drm,
   207					    "[CRTC:%d:%s] pfit center mode source (%dx%d) exceeds display (%dx%d)\n",
   208					    crtc->base.base.id, crtc->base.name,
 > 209					    width, height,
   210					    adjusted_mode->crtc_hdisplay,
   211					    adjusted_mode->crtc_vdisplay);
   212				return -EINVAL;
   213			}
   214			width = pipe_src_w;
   215			height = pipe_src_h;
   216			x = (adjusted_mode->crtc_hdisplay - width + 1)/2;
   217			y = (adjusted_mode->crtc_vdisplay - height + 1)/2;
   218			break;
   219	
   220		case DRM_MODE_SCALE_ASPECT:
   221			/* Scale but preserve the aspect ratio */
   222			{
   223				u32 scaled_width = adjusted_mode->crtc_hdisplay * pipe_src_h;
   224				u32 scaled_height = pipe_src_w * adjusted_mode->crtc_vdisplay;
   225	
   226				if (scaled_width > scaled_height) { /* pillar */
   227					width = scaled_height / pipe_src_h;
   228					if (width & 1)
   229						width++;
   230					x = (adjusted_mode->crtc_hdisplay - width + 1) / 2;
   231					y = 0;
   232					height = adjusted_mode->crtc_vdisplay;
   233				} else if (scaled_width < scaled_height) { /* letter */
   234					height = scaled_width / pipe_src_w;
   235					if (height & 1)
   236						height++;
   237					y = (adjusted_mode->crtc_vdisplay - height + 1) / 2;
   238					x = 0;
   239					width = adjusted_mode->crtc_hdisplay;
   240				} else {
   241					x = y = 0;
   242					width = adjusted_mode->crtc_hdisplay;
   243					height = adjusted_mode->crtc_vdisplay;
   244				}
   245			}
   246			break;
   247	
   248		case DRM_MODE_SCALE_NONE:
   249			WARN_ON(adjusted_mode->crtc_hdisplay != pipe_src_w);
   250			WARN_ON(adjusted_mode->crtc_vdisplay != pipe_src_h);
   251			fallthrough;
   252		case DRM_MODE_SCALE_FULLSCREEN:
   253			x = y = 0;
   254			width = adjusted_mode->crtc_hdisplay;
   255			height = adjusted_mode->crtc_vdisplay;
   256			break;
   257	
   258		default:
   259			MISSING_CASE(conn_state->scaling_mode);
   260			return -EINVAL;
   261		}
   262	
   263		drm_rect_init(&crtc_state->pch_pfit.dst,
   264			      x, y, width, height);
   265		crtc_state->pch_pfit.enabled = true;
   266	
   267		/*
   268		 * SKL+ have unified scalers for pipes/planes so the
   269		 * checks are done in a single place for all scalers.
   270		 */
   271		if (DISPLAY_VER(display) >= 9)
   272			return 0;
   273	
   274		ret = intel_pch_pfit_check_dst_window(crtc_state);
   275		if (ret)
   276			return ret;
   277	
   278		ret = intel_pch_pfit_check_src_size(crtc_state);
   279		if (ret)
   280			return ret;
   281	
   282		ret = intel_pch_pfit_check_scaling(crtc_state);
   283		if (ret)
   284			return ret;
   285	
   286		ret = intel_pch_pfit_check_timings(crtc_state);
   287		if (ret)
   288			return ret;
   289	
   290		ret = intel_pch_pfit_check_cloning(crtc_state);
   291		if (ret)
   292			return ret;
   293	
   294		return 0;
   295	}
   296	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

[PATCH] drm/i915/pfit: Prevent negative coordinates in center mode

[Nemesa Garg]

When the pipe_src width or height are greater than adjusted_mode hdisplay
and vdisplay, computed x and y offsets for center mode can be negative.
Writing negative values into the pch_fit registers result in a state error.
Add a check to clamp these values so that they are never negative.

v2: Compare in terms of pipe_src width and height.[Ville]
v3: Change width/height to pipe_src_w/h in logging. [Ville]

Signed-off-by: Nemesa Garg <nemesa.garg@intel.com>
---
 drivers/gpu/drm/i915/display/intel_pfit.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_pfit.c b/drivers/gpu/drm/i915/display/intel_pfit.c
index 6dda496190e0..2dec4ccf74ce 100644
--- a/drivers/gpu/drm/i915/display/intel_pfit.c
+++ b/drivers/gpu/drm/i915/display/intel_pfit.c
@@ -186,6 +186,7 @@ static int pch_panel_fitting(struct intel_crtc_state *crtc_state,
 			     const struct drm_connector_state *conn_state)
 {
 	struct intel_display *display = to_intel_display(crtc_state);
+	struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc);
 	const struct drm_display_mode *adjusted_mode =
 		&crtc_state->hw.adjusted_mode;
 	int pipe_src_w = drm_rect_width(&crtc_state->pipe_src);
@@ -200,6 +201,16 @@ static int pch_panel_fitting(struct intel_crtc_state *crtc_state,
 
 	switch (conn_state->scaling_mode) {
 	case DRM_MODE_SCALE_CENTER:
+		if (adjusted_mode->crtc_hdisplay < pipe_src_w ||
+		    adjusted_mode->crtc_vdisplay < pipe_src_h) {
+			drm_dbg_kms(display->drm,
+				    "[CRTC:%d:%s] pfit center mode source (%dx%d) exceeds display (%dx%d)\n",
+				    crtc->base.base.id, crtc->base.name,
+				    pipe_src_w, pipe_src_h,
+				    adjusted_mode->crtc_hdisplay,
+				    adjusted_mode->crtc_vdisplay);
+			return -EINVAL;
+		}
 		width = pipe_src_w;
 		height = pipe_src_h;
 		x = (adjusted_mode->crtc_hdisplay - width + 1)/2;
-- 
2.25.1

Re: [PATCH] drm/i915/pfit: Prevent negative coordinates in center mode

[Ville Syrjälä]

On Thu, Apr 02, 2026 at 11:43:10AM +0530, Nemesa Garg wrote:
> When the pipe_src width or height are greater than adjusted_mode hdisplay
> and vdisplay, computed x and y offsets for center mode can be negative.
> Writing negative values into the pch_fit registers result in a state error.
> Add a check to clamp these values so that they are never negative.
> 
> v2: Compare in terms of pipe_src width and height.[Ville]
> v3: Change width/height to pipe_src_w/h in logging. [Ville]
> 
> Signed-off-by: Nemesa Garg <nemesa.garg@intel.com>

Thanks. Applied to drm-intel-next.

In the future please look into using the git format-patch -v<n>
and git send-email --in-reply-to knobs, especially for single
patches. Makes it easier to find the new versions of the patch.
When reposting a whole series one should not use --in-reply-to
however.

> ---
>  drivers/gpu/drm/i915/display/intel_pfit.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/gpu/drm/i915/display/intel_pfit.c b/drivers/gpu/drm/i915/display/intel_pfit.c
> index 6dda496190e0..2dec4ccf74ce 100644
> --- a/drivers/gpu/drm/i915/display/intel_pfit.c
> +++ b/drivers/gpu/drm/i915/display/intel_pfit.c
> @@ -186,6 +186,7 @@ static int pch_panel_fitting(struct intel_crtc_state *crtc_state,
>  			     const struct drm_connector_state *conn_state)
>  {
>  	struct intel_display *display = to_intel_display(crtc_state);
> +	struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc);
>  	const struct drm_display_mode *adjusted_mode =
>  		&crtc_state->hw.adjusted_mode;
>  	int pipe_src_w = drm_rect_width(&crtc_state->pipe_src);
> @@ -200,6 +201,16 @@ static int pch_panel_fitting(struct intel_crtc_state *crtc_state,
>  
>  	switch (conn_state->scaling_mode) {
>  	case DRM_MODE_SCALE_CENTER:
> +		if (adjusted_mode->crtc_hdisplay < pipe_src_w ||
> +		    adjusted_mode->crtc_vdisplay < pipe_src_h) {
> +			drm_dbg_kms(display->drm,
> +				    "[CRTC:%d:%s] pfit center mode source (%dx%d) exceeds display (%dx%d)\n",
> +				    crtc->base.base.id, crtc->base.name,
> +				    pipe_src_w, pipe_src_h,
> +				    adjusted_mode->crtc_hdisplay,
> +				    adjusted_mode->crtc_vdisplay);
> +			return -EINVAL;
> +		}
>  		width = pipe_src_w;
>  		height = pipe_src_h;
>  		x = (adjusted_mode->crtc_hdisplay - width + 1)/2;
> -- 
> 2.25.1

-- 
Ville Syrjälä
Intel