Commit f2bfce6c authored Sep 30, 2024 by Hersen Wu Committed by Huang Xiaojia Sep 30, 2024

drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box

stable inclusion
from stable-v6.6.50
commit 4003bac784380fed1f94f197350567eaa73a409d
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LY
CVE: CVE-2024-46811

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4003bac784380fed1f94f197350567eaa73a409d



--------------------------------

[ Upstream commit 188fd1616ec43033cedbe343b6579e9921e2d898 ]

[Why]
Coverity reports OVERRUN warning. soc.num_states could
be 40. But array range of bw_params->clk_table.entries is 8.

[How]
Assert if soc.num_states greater than 8.

Reviewed-by: Alex Hung <alex.hung@amd.com>
Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Hersen Wu <hersenxs.wu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Huang Xiaojia <huangxiaojia2@huawei.com>

parent 02590a1a

drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -304,6 +304,16 @@ void dcn302_fpu_update_bw_bounding_box(struct dc dc, struct clk_bw_params bw_p
		dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
		}

		/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
		* MAX_NUM_DPM_LVL is 8.
		* dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
		* DC__VOLTAGE_STATES is 40.
		*/
		if (num_states > MAX_NUM_DPM_LVL) {
		ASSERT(0);
		return;
		}

		dcn3_02_soc.num_states = num_states;
		for (i = 0; i < dcn3_02_soc.num_states; i++) {
		dcn3_02_soc.clock_limits[i].state = i;

drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -299,6 +299,16 @@ void dcn303_fpu_update_bw_bounding_box(struct dc dc, struct clk_bw_params bw_p
		dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
		}

		/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
		* MAX_NUM_DPM_LVL is 8.
		* dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
		* DC__VOLTAGE_STATES is 40.
		*/
		if (num_states > MAX_NUM_DPM_LVL) {
		ASSERT(0);
		return;
		}

		dcn3_03_soc.num_states = num_states;
		for (i = 0; i < dcn3_03_soc.num_states; i++) {
		dcn3_03_soc.clock_limits[i].state = i;

drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -2885,6 +2885,16 @@ void dcn32_update_bw_bounding_box_fpu(struct dc dc, struct clk_bw_params bw_pa
		dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
		}

		/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
		* MAX_NUM_DPM_LVL is 8.
		* dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
		* DC__VOLTAGE_STATES is 40.
		*/
		if (num_states > MAX_NUM_DPM_LVL) {
		ASSERT(0);
		return;
		}

		dcn3_2_soc.num_states = num_states;
		for (i = 0; i < dcn3_2_soc.num_states; i++) {
		dcn3_2_soc.clock_limits[i].state = i;

drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -789,6 +789,16 @@ void dcn321_update_bw_bounding_box_fpu(struct dc dc, struct clk_bw_params bw_p
		dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
		}

		/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
		* MAX_NUM_DPM_LVL is 8.
		* dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
		* DC__VOLTAGE_STATES is 40.
		*/
		if (num_states > MAX_NUM_DPM_LVL) {
		ASSERT(0);
		return;
		}

		dcn3_21_soc.num_states = num_states;
		for (i = 0; i < dcn3_21_soc.num_states; i++) {
		dcn3_21_soc.clock_limits[i].state = i;