Commit 2c437d9a authored by Leo Chen's avatar Leo Chen Committed by Alex Deucher
Browse files

drm/amd/display: Adding array index check to prevent memory corruption 



[Why & How]
Array indices out of bound caused memory corruption. Adding checks to
ensure that array index stays in bound.

Reviewed-by: default avatarCharlene Liu <charlene.liu@amd.com>
Reviewed-by: default avatarNicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: default avatarLeo Chen <leo.chen@amd.com>
Signed-off-by: default avatarWayne Lin <wayne.lin@amd.com>
Tested-by: default avatarDaniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 41094c60

drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c

+4 −2
Original line number Diff line number Diff line
@@ -257,11 +257,11 @@ static void dcn35_notify_host_router_bw(struct clk_mgr *clk_mgr_base, struct dc_ 
	struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base);

	uint32_t host_router_bw_kbps[MAX_HOST_ROUTERS_NUM] = { 0 };

	int i;



	for (i = 0; i < context->stream_count; ++i) {

		const struct dc_stream_state *stream = context->streams[i];

		const struct dc_link *link = stream->link;

		uint8_t lowest_dpia_index = 0, hr_index = 0;

		uint8_t lowest_dpia_index = 0;

		unsigned int hr_index = 0;



		if (!link)

			continue;
@@ -271,6 +271,8 @@ static void dcn35_notify_host_router_bw(struct clk_mgr *clk_mgr_base, struct dc_ 
			continue;



		hr_index = (link->link_index - lowest_dpia_index) / 2;

		if (hr_index >= MAX_HOST_ROUTERS_NUM)

			continue;

		host_router_bw_kbps[hr_index] += dc_bandwidth_in_kbps_from_timing(

			&stream->timing, dc_link_get_highest_encoding_format(link));

	}