[PATCH] drm/amd/display: Ensure HPD source index is valid for dcn20/dcn201 link encoders

[Li, Roman]

[Public]

Reviewed-by: Roman Li <roman.li at amd.com>

> -----Original Message-----
> From: SHANMUGAM, SRINIVASAN <SRINIVASAN.SHANMUGAM at amd.com>
> Sent: Wednesday, October 16, 2024 9:19 AM
> To: Siqueira, Rodrigo <Rodrigo.Siqueira at amd.com>; Pillai, Aurabindo
> <Aurabindo.Pillai at amd.com>
> Cc: amd-gfx at lists.freedesktop.org; SHANMUGAM, SRINIVASAN
> <SRINIVASAN.SHANMUGAM at amd.com>; Chung, ChiaHsuan (Tom)
> <ChiaHsuan.Chung at amd.com>; Li, Roman <Roman.Li at amd.com>; Hung, Alex
> <Alex.Hung at amd.com>; Wentland, Harry <Harry.Wentland at amd.com>; Mahfooz,
> Hamza <Hamza.Mahfooz at amd.com>
> Subject: [PATCH] drm/amd/display: Ensure HPD source index is valid for
> dcn20/dcn201 link encoders
>
> This patch adds a boundary check for the hpd_source index during the link encoder
> creation process for dcn20/dcn201 IP's. The check ensures that the index is within
> the valid range of the link_enc_hpd_regs array to prevent out-of-bounds access.
>
> Cc: Tom Chung <chiahsuan.chung at amd.com>
> Cc: Rodrigo Siqueira <Rodrigo.Siqueira at amd.com>
> Cc: Roman Li <roman.li at amd.com>
> Cc: Alex Hung <alex.hung at amd.com>
> Cc: Aurabindo Pillai <aurabindo.pillai at amd.com>
> Cc: Harry Wentland <harry.wentland at amd.com>
> Cc: Hamza Mahfooz <hamza.mahfooz at amd.com>
> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam at amd.com>
> ---
>  drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c  | 2 +-
>  .../gpu/drm/amd/display/dc/resource/dcn201/dcn201_resource.c    | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c
> index eea2b3b307cd..288189913e1e 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn20/dcn20_resource.c
> @@ -920,7 +920,7 @@ struct link_encoder *dcn20_link_encoder_create(
>               kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
>       int link_regs_id;
>
> -     if (!enc20)
> +     if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
>               return NULL;
>
>       link_regs_id =
> diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn201/dcn201_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn201/dcn201_resource.c
> index fc54483b9104..15180ad71513 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn201/dcn201_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn201/dcn201_resource.c
> @@ -797,7 +797,7 @@ static struct link_encoder *dcn201_link_encoder_create(
>               kzalloc(sizeof(struct dcn20_link_encoder), GFP_ATOMIC);
>       struct dcn10_link_encoder *enc10;
>
> -     if (!enc20)
> +     if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
>               return NULL;
>
>       enc10 = &enc20->enc10;
> --
> 2.34.1