drm/amd/display: Fix buffer overflow in 'get_host_router_total_dp_tunnel_bw()'

From Srinivasan Shanmugam
7211800091a9e2d49ad34f59d47321ca09ae30a7 in linux-6.6.y/6.6.19
97cba232549b9fe7e491fb60a69cf93075015f29 in mainline linux

diff --git a/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c b/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
index 7a6e42b..3db9489 100644 (file)
--- a/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
+++ b/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
@@ -196,7 +196,7 @@ static int get_host_router_total_dp_tunnel_bw(const struct dc *dc, uint8_t hr_in
        struct dc_link *link_dpia_primary, *link_dpia_secondary;
        int total_bw = 0;
 
-       for (uint8_t i = 0; i < MAX_PIPES * 2; ++i) {
+       for (uint8_t i = 0; i < (MAX_PIPES * 2) - 1; ++i) {
 
                if (!dc->links[i] || dc->links[i]->ep_type != DISPLAY_ENDPOINT_USB4_DPIA)
                        continue;