tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

drm/amd/display: Add hpd_source index out-of-bounds check for dcn3x link encoder creation

This patch adds a boundary check for the hpd_source index during the
link encoder creation process for dcn3x IP's. The check ensures that the
index is within the valid range of the link_enc_hpd_regs array to
prevent out-of-bounds access.

Cc: Tom Chung <chiahsuan.chung@amd.com>
Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Cc: Roman Li <roman.li@amd.com>
Cc: Alex Hung <alex.hung@amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Cc: Harry Wentland <harry.wentland@amd.com>
Cc: Hamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Roman Li <roman.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

authored by

Srinivasan Shanmugam and committed by
Alex Deucher 1791bd09 144df260

+12 -12
+1 -1
drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c
··· 927 927 struct dcn20_link_encoder *enc20 = 928 928 kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL); 929 929 930 - if (!enc20) 930 + if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) 931 931 return NULL; 932 932 933 933 dcn30_link_encoder_construct(enc20,
+1 -1
drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
··· 883 883 struct dcn20_link_encoder *enc20 = 884 884 kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL); 885 885 886 - if (!enc20) 886 + if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) 887 887 return NULL; 888 888 889 889 dcn301_link_encoder_construct(enc20,
+1 -1
drivers/gpu/drm/amd/display/dc/resource/dcn302/dcn302_resource.c
··· 893 893 { 894 894 struct dcn20_link_encoder *enc20 = kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL); 895 895 896 - if (!enc20) 896 + if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) 897 897 return NULL; 898 898 899 899 dcn30_link_encoder_construct(enc20, enc_init_data, &link_enc_feature,
+1 -1
drivers/gpu/drm/amd/display/dc/resource/dcn303/dcn303_resource.c
··· 839 839 { 840 840 struct dcn20_link_encoder *enc20 = kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL); 841 841 842 - if (!enc20) 842 + if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) 843 843 return NULL; 844 844 845 845 dcn30_link_encoder_construct(enc20, enc_init_data, &link_enc_feature,
+1 -1
drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
··· 1093 1093 struct dcn20_link_encoder *enc20 = 1094 1094 kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL); 1095 1095 1096 - if (!enc20) 1096 + if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) 1097 1097 return NULL; 1098 1098 1099 1099 dcn31_link_encoder_construct(enc20,
+1 -1
drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
··· 1149 1149 struct dcn20_link_encoder *enc20 = 1150 1150 kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL); 1151 1151 1152 - if (!enc20) 1152 + if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) 1153 1153 return NULL; 1154 1154 1155 1155 dcn31_link_encoder_construct(enc20,
+1 -1
drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c
··· 1091 1091 struct dcn20_link_encoder *enc20 = 1092 1092 kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL); 1093 1093 1094 - if (!enc20) 1094 + if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) 1095 1095 return NULL; 1096 1096 1097 1097 dcn31_link_encoder_construct(enc20,
+1 -1
drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c
··· 1085 1085 struct dcn20_link_encoder *enc20 = 1086 1086 kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL); 1087 1087 1088 - if (!enc20) 1088 + if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) 1089 1089 return NULL; 1090 1090 1091 1091 dcn31_link_encoder_construct(enc20,
+1 -1
drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
··· 1039 1039 struct dcn20_link_encoder *enc20 = 1040 1040 kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL); 1041 1041 1042 - if (!enc20) 1042 + if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) 1043 1043 return NULL; 1044 1044 1045 1045 #undef REG_STRUCT
+1 -1
drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c
··· 1035 1035 struct dcn20_link_encoder *enc20 = 1036 1036 kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL); 1037 1037 1038 - if (!enc20) 1038 + if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) 1039 1039 return NULL; 1040 1040 1041 1041 #undef REG_STRUCT
+1 -1
drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
··· 1074 1074 struct dcn20_link_encoder *enc20 = 1075 1075 kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL); 1076 1076 1077 - if (!enc20) 1077 + if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) 1078 1078 return NULL; 1079 1079 1080 1080 #undef REG_STRUCT
+1 -1
drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c
··· 1054 1054 struct dcn20_link_encoder *enc20 = 1055 1055 kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL); 1056 1056 1057 - if (!enc20) 1057 + if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) 1058 1058 return NULL; 1059 1059 1060 1060 #undef REG_STRUCT