Commit 00c831b7 authored by Alex Hung's avatar Alex Hung Committed by Zhao Wenhui
Browse files

drm/amd/display: Skip finding free audio for unknown engine_id 

stable inclusion
from stable-v5.10.222
commit ffa7bd3ca9cfa902b857d1dc9a5f46fededf86c8
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGT0E
CVE: CVE-2024-42119

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=ffa7bd3ca9cfa902b857d1dc9a5f46fededf86c8



--------------------------------

[ Upstream commit 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3 ]

[WHY]
ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it
also means it is uninitialized and does not need free audio.

[HOW]
Skip and return NULL.

This fixes 2 OVERRUN issues reported by Coverity.

Reviewed-by: default avatarRodrigo Siqueira <rodrigo.siqueira@amd.com>
Acked-by: default avatarWayne Lin <wayne.lin@amd.com>
Signed-off-by: default avatarAlex Hung <alex.hung@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZhao Wenhui <zhaowenhui8@huawei.com>
parent a41e8dae

drivers/gpu/drm/amd/display/dc/core/dc_resource.c

+3 −0
Original line number Diff line number Diff line
@@ -1802,6 +1802,9 @@ static struct audio *find_first_free_audio( 
{

	int i, available_audio_count;



	if (id == ENGINE_ID_UNKNOWN)

		return NULL;



	available_audio_count = pool->audio_count;



	for (i = 0; i < available_audio_count; i++) {