Commit 46806e59 authored by Roman Li's avatar Roman Li Committed by Alex Deucher
Browse files

drm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr 



[Why]
There is a potential memory access violation while
iterating through array of dcn35 clks.

[How]
Limit iteration per array size.

Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Reviewed-by: default avatarNicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Acked-by: default avatarAurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: default avatarRoman Li <roman.li@amd.com>
Tested-by: default avatarDaniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent deb11029

drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c

+11 −4
Original line number Diff line number Diff line
@@ -655,10 +655,13 @@ static void dcn35_clk_mgr_helper_populate_bw_params(struct clk_mgr_internal *clk 
	struct clk_limit_table_entry def_max = bw_params->clk_table.entries[bw_params->clk_table.num_entries - 1];

	uint32_t max_fclk = 0, min_pstate = 0, max_dispclk = 0, max_dppclk = 0;

	uint32_t max_pstate = 0, max_dram_speed_mts = 0, min_dram_speed_mts = 0;

	uint32_t num_memps, num_fclk, num_dcfclk;

	int i;



	/* Determine min/max p-state values. */

	for (i = 0; i < clock_table->NumMemPstatesEnabled; i++) {

	num_memps = (clock_table->NumMemPstatesEnabled > NUM_MEM_PSTATE_LEVELS) ? NUM_MEM_PSTATE_LEVELS :

		clock_table->NumMemPstatesEnabled;

	for (i = 0; i < num_memps; i++) {

		uint32_t dram_speed_mts = calc_dram_speed_mts(&clock_table->MemPstateTable[i]);



		if (is_valid_clock_value(dram_speed_mts) && dram_speed_mts > max_dram_speed_mts) {
@@ -670,7 +673,7 @@ static void dcn35_clk_mgr_helper_populate_bw_params(struct clk_mgr_internal *clk 
	min_dram_speed_mts = max_dram_speed_mts;

	min_pstate = max_pstate;



	for (i = 0; i < clock_table->NumMemPstatesEnabled; i++) {

	for (i = 0; i < num_memps; i++) {

		uint32_t dram_speed_mts = calc_dram_speed_mts(&clock_table->MemPstateTable[i]);



		if (is_valid_clock_value(dram_speed_mts) && dram_speed_mts < min_dram_speed_mts) {
@@ -699,9 +702,13 @@ static void dcn35_clk_mgr_helper_populate_bw_params(struct clk_mgr_internal *clk 
	/* Base the clock table on dcfclk, need at least one entry regardless of pmfw table */

	ASSERT(clock_table->NumDcfClkLevelsEnabled > 0);



	max_fclk = find_max_clk_value(clock_table->FclkClocks_Freq, clock_table->NumFclkLevelsEnabled);

	num_fclk = (clock_table->NumFclkLevelsEnabled > NUM_FCLK_DPM_LEVELS) ? NUM_FCLK_DPM_LEVELS :

		clock_table->NumFclkLevelsEnabled;

	max_fclk = find_max_clk_value(clock_table->FclkClocks_Freq, num_fclk);



	for (i = 0; i < clock_table->NumDcfClkLevelsEnabled; i++) {

	num_dcfclk = (clock_table->NumFclkLevelsEnabled > NUM_DCFCLK_DPM_LEVELS) ? NUM_DCFCLK_DPM_LEVELS :

		clock_table->NumDcfClkLevelsEnabled;

	for (i = 0; i < num_dcfclk; i++) {

		int j;



		/* First search defaults for the clocks we don't read using closest lower or equal default dcfclk */