[PATCH] drm/amd/display: fix the crtc array out of bound issue.

[Zhang, Yifan]

[AMD Official Use Only - General]

Ping

Best Regards,
Yifan

-----Original Message-----
From: Zhang, Yifan <Yifan1.Zhang at amd.com> 
Sent: Monday, December 12, 2022 8:40 PM
To: amd-gfx at lists.freedesktop.org
Cc: Wentland, Harry <Harry.Wentland at amd.com>; Liu, HaoPing (Alan) <HaoPing.Liu at amd.com>; Zhang, Yifan <Yifan1.Zhang at amd.com>
Subject: [PATCH] drm/amd/display: fix the crtc array out of bound issue.

adev->dm.dc->caps.max_links could be larger than AMDGPU_MAX_CRTCS,
change the iteration upper limit to AMDGPU_MAX_CRTCS to fix the issue.

[  276.069644] ================================================================================
[  276.069652] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_crc.c:550:55
[  276.069660] index 6 is out of range for type 'amdgpu_crtc *[6]'
[  276.069665] CPU: 11 PID: 1092 Comm: modprobe Tainted: G           OE     5.19.0+ #15

Signed-off-by: Yifan Zhang <yifan1.zhang at amd.com>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
index 8bf33fa4abd9..af2230797be9 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
@@ -217,7 +217,7 @@ int amdgpu_dm_crtc_configure_crc_source(struct drm_crtc *crtc,  #if defined(CONFIG_DRM_AMD_SECURE_DISPLAY)
 		/* Disable secure_display if it was enabled */
 		if (!enable) {
-			for (i = 0; i < adev->dm.dc->caps.max_links; i++) {
+			for (i = 0; i < AMDGPU_MAX_CRTCS; i++) {
 				if (adev->dm.secure_display_ctxs[i].crtc == crtc) {
 					/* stop ROI update on this crtc */
 					flush_work(&adev->dm.secure_display_ctxs[i].notify_ta_work);
@@ -543,7 +543,7 @@ amdgpu_dm_crtc_secure_display_create_contexts(struct amdgpu_device *adev)
 	if (!secure_display_ctxs)
 		return NULL;
 
-	for (i = 0; i < adev->dm.dc->caps.max_links; i++) {
+	for (i = 0; i < AMDGPU_MAX_CRTCS; i++) {
 		INIT_WORK(&secure_display_ctxs[i].forward_roi_work, amdgpu_dm_forward_crc_window);
 		INIT_WORK(&secure_display_ctxs[i].notify_ta_work, amdgpu_dm_crtc_notify_ta_to_read);
 		secure_display_ctxs[i].crtc = &adev->mode_info.crtcs[i]->base;
--
2.37.3