From: jsg <jsg@openbsd.org>
Date: Mon, 19 Feb 2024 01:54:46 +0000 (+0000)
Subject: drm/amd/display: Implement bounds check for stream encoder creation in DCN301
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=4790cc2fb10f269d803d79224fe16ff98135c51e;p=openbsd

drm/amd/display: Implement bounds check for stream encoder creation in DCN301

From Srinivasan Shanmugam
cd9bd10c59e3c1446680514fd3097c5b00d3712d in linux-6.6.y/6.6.17
58fca355ad37dcb5f785d9095db5f748b79c5dc2 in mainline linux
---

diff --git a/sys/dev/pci/drm/amd/display/dc/dcn301/dcn301_resource.c b/sys/dev/pci/drm/amd/display/dc/dcn301/dcn301_resource.c
index 79d6697d13b..9485fda890c 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn301/dcn301_resource.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn301/dcn301_resource.c
@@ -996,7 +996,7 @@ static struct stream_encoder *dcn301_stream_encoder_create(enum engine_id eng_id
 	vpg = dcn301_vpg_create(ctx, vpg_inst);
 	afmt = dcn301_afmt_create(ctx, afmt_inst);
 
-	if (!enc1 || !vpg || !afmt) {
+	if (!enc1 || !vpg || !afmt || eng_id >= ARRAY_SIZE(stream_enc_regs)) {
 		kfree(enc1);
 		kfree(vpg);
 		kfree(afmt);