Commit e5a9ec6b authored by Alex Hung's avatar Alex Hung Committed by Qi Xi
Browse files

drm/amd/display: Check index for aux_rd_interval before using 

mainline inclusion
from mainline-v6.11-rc1
commit 9ba2ea6337b4f159aecb177555a6a81da92d302e
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV7O
CVE: CVE-2024-46728

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9ba2ea6337b4f159aecb177555a6a81da92d302e



--------------------------------

aux_rd_interval has size of 7 and should be checked.

This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity.

Reviewed-by: default avatarRodrigo Siqueira <rodrigo.siqueira@amd.com>
Acked-by: default avatarTom Chung <chiahsuan.chung@amd.com>
Signed-off-by: default avatarAlex Hung <alex.hung@amd.com>
Tested-by: default avatarDaniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarQi Xi <xiqi2@huawei.com>
parent 5d76abff

drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c

+2 −2
Original line number Diff line number Diff line
@@ -914,10 +914,10 @@ static enum dc_status configure_lttpr_mode_non_transparent( 
			/* Driver does not need to train the first hop. Skip DPCD read and clear

			 * AUX_RD_INTERVAL for DPTX-to-DPIA hop.

			 */

			if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA)

			if (link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA && repeater_cnt > 0 && repeater_cnt < MAX_REPEATER_CNT)

				link->dpcd_caps.lttpr_caps.aux_rd_interval[--repeater_cnt] = 0;



			for (repeater_id = repeater_cnt; repeater_id > 0; repeater_id--) {

			for (repeater_id = repeater_cnt; repeater_id > 0 && repeater_id < MAX_REPEATER_CNT; repeater_id--) {

				aux_interval_address = DP_TRAINING_AUX_RD_INTERVAL_PHY_REPEATER1 +

						((DP_REPEATER_CONFIGURATION_AND_STATUS_SIZE) * (repeater_id - 1));

				core_link_read_dpcd(