Commit 9704906e authored Oct 08, 2024 by Alex Hung Committed by Zeng Heng Oct 08, 2024

drm/amd/display: Check gpio_id before used as array index

stable inclusion
from stable-v5.10.226
commit 40c2e8bc117cab8bca8814735f28a8b121654a84
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9MK
CVE: CVE-2024-46818

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=40c2e8bc117cab8bca8814735f28a8b121654a84



--------------------------------

[ Upstream commit 2a5626eeb3b5eec7a36886f9556113dd93ec8ed6 ]

[WHY & HOW]
GPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore
should be checked in advance.

This fixes 5 OVERRUN issues reported by Coverity.

Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Zeng Heng <zengheng4@huawei.com>

parent e1994ce0

drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c

+11 −2

Original line number	Diff line number	Diff line
		@@ -241,6 +241,9 @@ static bool is_pin_busy(
		enum gpio_id id,
		uint32_t en)
		{
		if (id == GPIO_ID_UNKNOWN)
		return false;

		return service->busyness[id][en];
		}

		@@ -249,6 +252,9 @@ static void set_pin_busy(
		enum gpio_id id,
		uint32_t en)
		{
		if (id == GPIO_ID_UNKNOWN)
		return;

		service->busyness[id][en] = true;
		}

		@@ -257,6 +263,9 @@ static void set_pin_free(
		enum gpio_id id,
		uint32_t en)
		{
		if (id == GPIO_ID_UNKNOWN)
		return;

		service->busyness[id][en] = false;
		}

		@@ -265,7 +274,7 @@ enum gpio_result dal_gpio_service_lock(
		enum gpio_id id,
		uint32_t en)
		{
		if (!service->busyness[id]) {
		if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) {
		ASSERT_CRITICAL(false);
		return GPIO_RESULT_OPEN_FAILED;
		}
		@@ -279,7 +288,7 @@ enum gpio_result dal_gpio_service_unlock(
		enum gpio_id id,
		uint32_t en)
		{
		if (!service->busyness[id]) {
		if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) {
		ASSERT_CRITICAL(false);
		return GPIO_RESULT_OPEN_FAILED;
		}