Commit 9d9d0e24 authored by Alex Hung's avatar Alex Hung Committed by Tong Tiangen
Browse files

drm/amd/display: Ensure index calculation will not overflow 

stable inclusion
from stable-v6.6.50
commit 3dc6bb57dab36b38b7374af0ac916174c146b6ed
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV8L
CVE: CVE-2024-46726

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3dc6bb57dab36b38b7374af0ac916174c146b6ed



--------------------------------

[ Upstream commit 8e2734bf444767fed787305ccdcb36a2be5301a2 ]

[WHY & HOW]
Make sure vmid0p72_idx, vnom0p8_idx and vmax0p9_idx calculation will
never overflow and exceess array size.

This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.

Reviewed-by: default avatarHarry Wentland <harry.wentland@amd.com>
Acked-by: default avatarTom Chung <chiahsuan.chung@amd.com>
Signed-off-by: default avatarAlex Hung <alex.hung@amd.com>
Tested-by: default avatarDaniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarTong Tiangen <tongtiangen@huawei.com>
parent 30113d28

drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c

+3 −4
Original line number Diff line number Diff line
@@ -1453,10 +1453,9 @@ void dcn_bw_update_from_pplib_fclks( 
	ASSERT(fclks->num_levels);



	vmin0p65_idx = 0;

	vmid0p72_idx = fclks->num_levels -

		(fclks->num_levels > 2 ? 3 : (fclks->num_levels > 1 ? 2 : 1));

	vnom0p8_idx = fclks->num_levels - (fclks->num_levels > 1 ? 2 : 1);

	vmax0p9_idx = fclks->num_levels - 1;

	vmid0p72_idx = fclks->num_levels > 2 ? fclks->num_levels - 3 : 0;

	vnom0p8_idx = fclks->num_levels > 1 ? fclks->num_levels - 2 : 0;

	vmax0p9_idx = fclks->num_levels > 0 ? fclks->num_levels - 1 : 0;



	dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 =

		32 * (fclks->data[vmin0p65_idx].clocks_in_khz / 1000.0) / 1000.0;