Commit f39e1270 authored by Alex Deucher's avatar Alex Deucher
Browse files

drm/amdgpu/gmc9.0: add bounds checking for cid 



The value should never exceed the array size as those
are the only values the hardware is expected to return,
but add checks anyway.

Cc: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: default avatarBenjamin Cheng <benjamin.cheng@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
(cherry picked from commit e14d4683)
Cc: stable@vger.kernel.org
parent 9c52f495

drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c

+14 −7
Original line number Diff line number Diff line
@@ -662,28 +662,35 @@ static int gmc_v9_0_process_interrupt(struct amdgpu_device *adev, 
	} else {

		switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {

		case IP_VERSION(9, 0, 0):

			mmhub_cid = mmhub_client_ids_vega10[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega10) ?

				mmhub_client_ids_vega10[cid][rw] : NULL;

			break;

		case IP_VERSION(9, 3, 0):

			mmhub_cid = mmhub_client_ids_vega12[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega12) ?

				mmhub_client_ids_vega12[cid][rw] : NULL;

			break;

		case IP_VERSION(9, 4, 0):

			mmhub_cid = mmhub_client_ids_vega20[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega20) ?

				mmhub_client_ids_vega20[cid][rw] : NULL;

			break;

		case IP_VERSION(9, 4, 1):

			mmhub_cid = mmhub_client_ids_arcturus[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_arcturus) ?

				mmhub_client_ids_arcturus[cid][rw] : NULL;

			break;

		case IP_VERSION(9, 1, 0):

		case IP_VERSION(9, 2, 0):

			mmhub_cid = mmhub_client_ids_raven[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_raven) ?

				mmhub_client_ids_raven[cid][rw] : NULL;

			break;

		case IP_VERSION(1, 5, 0):

		case IP_VERSION(2, 4, 0):

			mmhub_cid = mmhub_client_ids_renoir[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_renoir) ?

				mmhub_client_ids_renoir[cid][rw] : NULL;

			break;

		case IP_VERSION(1, 8, 0):

		case IP_VERSION(9, 4, 2):

			mmhub_cid = mmhub_client_ids_aldebaran[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_aldebaran) ?

				mmhub_client_ids_aldebaran[cid][rw] : NULL;

			break;

		default:

			mmhub_cid = NULL;