drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'

From Srinivasan Shanmugam
8f3e68c6a3fff53c2240762a47a0045d89371775 in linux-6.6.y/6.6.23
cdb637d339572398821204a1142d8d615668f1e9 in mainline linux

diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_discovery.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_discovery.c
index f1500b9..0a03218 100644 (file)
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_discovery.c
@@ -1287,11 +1287,10 @@ static int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev)
                                 *     0b10 : encode is disabled
                                 *     0b01 : decode is disabled
                                 */
-                               adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
-                                       ip->revision & 0xc0;
-                               ip->revision &= ~0xc0;
                                if (adev->vcn.num_vcn_inst <
                                    AMDGPU_MAX_VCN_INSTANCES) {
+                                       adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
+                                               ip->revision & 0xc0;
                                        adev->vcn.num_vcn_inst++;
                                        adev->vcn.inst_mask |=
                                                (1U << ip->instance_number);
@@ -1302,6 +1301,7 @@ static int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev)
                                                adev->vcn.num_vcn_inst + 1,
                                                AMDGPU_MAX_VCN_INSTANCES);
                                }
+                               ip->revision &= ~0xc0;
                        }
                        if (le16_to_cpu(ip->hw_id) == SDMA0_HWID ||
                            le16_to_cpu(ip->hw_id) == SDMA1_HWID ||