drm/amd/display: Avoid MPC infinite loop

From Josip Pavic
0c8abeceee0f58ad3fdc66e1de0c0e02b962653b in linux 5.15.y/5.15.65
8de297dc046c180651c0500f8611663ae1c3828a in mainline linux

diff --git a/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_mpc.c b/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_mpc.c
index 11019c2..8192f19 100644 (file)
--- a/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_mpc.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn10/dcn10_mpc.c
@@ -126,6 +126,12 @@ struct mpcc *mpc1_get_mpcc_for_dpp(struct mpc_tree *tree, int dpp_id)
        while (tmp_mpcc != NULL) {
                if (tmp_mpcc->dpp_id == dpp_id)
                        return tmp_mpcc;
+
+               /* avoid circular linked list */
+               ASSERT(tmp_mpcc != tmp_mpcc->mpcc_bot);
+               if (tmp_mpcc == tmp_mpcc->mpcc_bot)
+                       break;
+
                tmp_mpcc = tmp_mpcc->mpcc_bot;
        }
        return NULL;

diff --git a/sys/dev/pci/drm/amd/display/dc/dcn20/dcn20_mpc.c b/sys/dev/pci/drm/amd/display/dc/dcn20/dcn20_mpc.c
index 947eb0d..142fc0a 100644 (file)
--- a/sys/dev/pci/drm/amd/display/dc/dcn20/dcn20_mpc.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn20/dcn20_mpc.c
@@ -532,6 +532,12 @@ struct mpcc *mpc2_get_mpcc_for_dpp(struct mpc_tree *tree, int dpp_id)
        while (tmp_mpcc != NULL) {
                if (tmp_mpcc->dpp_id == 0xf || tmp_mpcc->dpp_id == dpp_id)
                        return tmp_mpcc;
+
+               /* avoid circular linked list */
+               ASSERT(tmp_mpcc != tmp_mpcc->mpcc_bot);
+               if (tmp_mpcc == tmp_mpcc->mpcc_bot)
+                       break;
+
                tmp_mpcc = tmp_mpcc->mpcc_bot;
        }
        return NULL;