drm/amd/display: Add hpd_source index out-of-bounds check for dcn3x link encoder...

This patch adds a boundary check for the hpd_source index during the
link encoder creation process for dcn3x IP's. The check ensures that the
index is within the valid range of the link_enc_hpd_regs array to
prevent out-of-bounds access.

Cc: Tom Chung <chiahsuan.chung@amd.com>
Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Cc: Roman Li <roman.li@amd.com>
Cc: Alex Hung <alex.hung@amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Cc: Harry Wentland <harry.wentland@amd.com>
Cc: Hamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Roman Li <roman.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c
index 5040a4c6ed186269e76ceb448c8005e33e9ff4b0..baa4e2647dadf41edefaaf9d97526e26544e0d60 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c
@@ -927,7 +927,7 @@ static struct link_encoder *dcn30_link_encoder_create(
        struct dcn20_link_encoder *enc20 =
                kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
 
-       if (!enc20)
+       if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
                return NULL;
 
        dcn30_link_encoder_construct(enc20,

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
index 7d04739c3ba14663b42d7502c9ff5b72567f0e7d..d8a7c2cf05de3ee4b98fa23d1a7e718a84781063 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
@@ -883,7 +883,7 @@ static struct link_encoder *dcn301_link_encoder_create(
        struct dcn20_link_encoder *enc20 =
                kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
 
-       if (!enc20)
+       if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
                return NULL;
 
        dcn301_link_encoder_construct(enc20,

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn302/dcn302_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn302/dcn302_resource.c
index 5791b5cc2875295091dea5f846d89867bf71ffec..40c20b04635a016309aa1f3c11b43d2de9683a66 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn302/dcn302_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn302/dcn302_resource.c
@@ -893,7 +893,7 @@ static struct link_encoder *dcn302_link_encoder_create(
 {
        struct dcn20_link_encoder *enc20 = kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
 
-       if (!enc20)
+       if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
                return NULL;
 
        dcn30_link_encoder_construct(enc20, enc_init_data, &link_enc_feature,

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn303/dcn303_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn303/dcn303_resource.c
index 63f0f882c8610cf985f000cdcdb57426f4e07a62..daf1b65fd0881025ecaae02a8b025081188fbfdb 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn303/dcn303_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn303/dcn303_resource.c
@@ -839,7 +839,7 @@ static struct link_encoder *dcn303_link_encoder_create(
 {
        struct dcn20_link_encoder *enc20 = kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
 
-       if (!enc20)
+       if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
                return NULL;
 
        dcn30_link_encoder_construct(enc20, enc_init_data, &link_enc_feature,

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
index ac8cb20e2e3b642d2f7a8faad35297e97cdaf5d7..36bb26182e117a79dd0ce55b1191d5bbb3a80f21 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
@@ -1093,7 +1093,7 @@ static struct link_encoder *dcn31_link_encoder_create(
        struct dcn20_link_encoder *enc20 =
                kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
 
-       if (!enc20)
+       if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
                return NULL;
 
        dcn31_link_encoder_construct(enc20,

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
index 169924d0a8393ee60fb34669db45ccad53ff635d..58a5fbcf22bfbc4d1ddf7271ba656592bea0738c 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
@@ -1149,7 +1149,7 @@ static struct link_encoder *dcn31_link_encoder_create(
        struct dcn20_link_encoder *enc20 =
                kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
 
-       if (!enc20)
+       if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
                return NULL;
 
        dcn31_link_encoder_construct(enc20,

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c
index f6b840f046a5d75396efb24049fdfb607ba8bea3..3acad708c31b8fffe8d04483b295e8467aba06bd 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c
@@ -1091,7 +1091,7 @@ static struct link_encoder *dcn31_link_encoder_create(
        struct dcn20_link_encoder *enc20 =
                kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
 
-       if (!enc20)
+       if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
                return NULL;
 
        dcn31_link_encoder_construct(enc20,

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c
index 5fd52c5fcee4585d95dd592ba922930f529c56a0..ce56f5d162c028e7cf54c7e5d5df0330ee3d6968 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c
@@ -1085,7 +1085,7 @@ static struct link_encoder *dcn31_link_encoder_create(
        struct dcn20_link_encoder *enc20 =
                kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
 
-       if (!enc20)
+       if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
                return NULL;
 
        dcn31_link_encoder_construct(enc20,

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
index a124ad9bd108c88d7e4953b1f7f5b6856cfa1998..a1890df29f5cc4773f4e5eb07776828df3527994 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
@@ -1039,7 +1039,7 @@ static struct link_encoder *dcn32_link_encoder_create(
        struct dcn20_link_encoder *enc20 =
                kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
 
-       if (!enc20)
+       if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
                return NULL;
 
 #undef REG_STRUCT

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c
index 827a94f84f10013bc4e5756ef548b60a71f4330f..35acc13cb5a9cc4415ab1cb54662bd8ef3565df5 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c
@@ -1035,7 +1035,7 @@ static struct link_encoder *dcn321_link_encoder_create(
        struct dcn20_link_encoder *enc20 =
                kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
 
-       if (!enc20)
+       if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
                return NULL;
 
 #undef REG_STRUCT

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
index 893a9d9ee870df9edafb49c4ee66a41ddc4f6654..795f2c71c70fbac970d6c31bc0c109958acab04f 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
@@ -1074,7 +1074,7 @@ static struct link_encoder *dcn35_link_encoder_create(
        struct dcn20_link_encoder *enc20 =
                kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
 
-       if (!enc20)
+       if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
                return NULL;
 
 #undef REG_STRUCT

diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c
index 70abd32ce2ad18c1475a1355437d0ef72e154b3c..0b8dc2eff596e69158e1c1f28ea9054224489dbd 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c
@@ -1054,7 +1054,7 @@ static struct link_encoder *dcn35_link_encoder_create(
        struct dcn20_link_encoder *enc20 =
                kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
 
-       if (!enc20)
+       if (!enc20 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs))
                return NULL;
 
 #undef REG_STRUCT