drm/amd/display: Implement bounds check for stream encoder creation in DCN301

From Srinivasan Shanmugam
cd9bd10c59e3c1446680514fd3097c5b00d3712d in linux-6.6.y/6.6.17
58fca355ad37dcb5f785d9095db5f748b79c5dc2 in mainline linux

diff --git a/sys/dev/pci/drm/amd/display/dc/dcn301/dcn301_resource.c b/sys/dev/pci/drm/amd/display/dc/dcn301/dcn301_resource.c
index 79d6697..9485fda 100644 (file)
--- a/sys/dev/pci/drm/amd/display/dc/dcn301/dcn301_resource.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn301/dcn301_resource.c
@@ -996,7 +996,7 @@ static struct stream_encoder *dcn301_stream_encoder_create(enum engine_id eng_id
        vpg = dcn301_vpg_create(ctx, vpg_inst);
        afmt = dcn301_afmt_create(ctx, afmt_inst);
 
-       if (!enc1 || !vpg || !afmt) {
+       if (!enc1 || !vpg || !afmt || eng_id >= ARRAY_SIZE(stream_enc_regs)) {
                kfree(enc1);
                kfree(vpg);
                kfree(afmt);