Commit 9e585541 authored Oct 08, 2024 by Alex Hung Committed by Zeng Heng Oct 08, 2024

drm/amd/display: Check gpio_id before used as array index

stable inclusion
from stable-v6.6.50
commit 08e7755f754e3d2cef7d3a7da538d33526bd6f7c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9MK
CVE: CVE-2024-46818

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=08e7755f754e3d2cef7d3a7da538d33526bd6f7c



--------------------------------

[ Upstream commit 2a5626eeb3b5eec7a36886f9556113dd93ec8ed6 ]

[WHY & HOW]
GPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore
should be checked in advance.

This fixes 5 OVERRUN issues reported by Coverity.

Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Zeng Heng <zengheng4@huawei.com>

parent 1f027a60

drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c

+11 −2

Original line number	Diff line number	Diff line
		@@ -239,6 +239,9 @@ static bool is_pin_busy(
		enum gpio_id id,
		uint32_t en)
		{
		if (id == GPIO_ID_UNKNOWN)
		return false;

		return service->busyness[id][en];
		}

		@@ -247,6 +250,9 @@ static void set_pin_busy(
		enum gpio_id id,
		uint32_t en)
		{
		if (id == GPIO_ID_UNKNOWN)
		return;

		service->busyness[id][en] = true;
		}

		@@ -255,6 +261,9 @@ static void set_pin_free(
		enum gpio_id id,
		uint32_t en)
		{
		if (id == GPIO_ID_UNKNOWN)
		return;

		service->busyness[id][en] = false;
		}

		@@ -263,7 +272,7 @@ enum gpio_result dal_gpio_service_lock(
		enum gpio_id id,
		uint32_t en)
		{
		if (!service->busyness[id]) {
		if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) {
		ASSERT_CRITICAL(false);
		return GPIO_RESULT_OPEN_FAILED;
		}
		@@ -277,7 +286,7 @@ enum gpio_result dal_gpio_service_unlock(
		enum gpio_id id,
		uint32_t en)
		{
		if (!service->busyness[id]) {
		if (id != GPIO_ID_UNKNOWN && !service->busyness[id]) {
		ASSERT_CRITICAL(false);
		return GPIO_RESULT_OPEN_FAILED;
		}