Commit 81bea8e9 authored by Hersen Wu's avatar Hersen Wu Committed by Cheng Yu
Browse files

drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links 

stable inclusion
from stable-v6.10.9
commit 36c39a8dcce210649f2f45f252abaa09fcc1ae87
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9L0
CVE: CVE-2024-46816

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=36c39a8dcce210649f2f45f252abaa09fcc1ae87



--------------------------------

[ Upstream commit cf8b16857db702ceb8d52f9219a4613363e2b1cf ]

[Why]
Coverity report OVERRUN warning. There are
only max_links elements within dc->links. link
count could up to AMDGPU_DM_MAX_DISPLAY_INDEX 31.

[How]
Make sure link count less than max_links.

Reviewed-by: default avatarHarry Wentland <harry.wentland@amd.com>
Acked-by: default avatarTom Chung <chiahsuan.chung@amd.com>
Signed-off-by: default avatarHersen Wu <hersenxs.wu@amd.com>
Tested-by: default avatarDaniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Conflicts:
        drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
[This conflict is caused by the lack of definition of the MAX_LINKS
variable. Manually adapt the variable value.]
Signed-off-by: default avatarCheng Yu <serein.chengyu@huawei.com>
parent 90c47c4a

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c

+7 −7
Original line number Diff line number Diff line
@@ -4450,17 +4450,17 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev) 
		}

	}



	/* loops over all connectors on the board */

	for (i = 0; i < link_cnt; i++) {

		struct dc_link *link = NULL;



		if (i > AMDGPU_DM_MAX_DISPLAY_INDEX) {

	if (link_cnt > MAX_PIPES * 2) {

		DRM_ERROR(

			"KMS: Cannot support more than %d display indexes\n",

					AMDGPU_DM_MAX_DISPLAY_INDEX);

			continue;

				MAX_PIPES * 2);

		goto fail;

	}



	/* loops over all connectors on the board */

	for (i = 0; i < link_cnt; i++) {

		struct dc_link *link = NULL;



		aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL);

		if (!aconnector)

			goto fail;