From: jsg <jsg@openbsd.org>
Date: Mon, 9 Sep 2024 09:05:54 +0000 (+0000)
Subject: drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=a2a3093830ec2686bdca329b90a192840bea1cbf;p=openbsd

drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box

From Hersen Wu
4003bac784380fed1f94f197350567eaa73a409d in linux-6.6.y/6.6.50
188fd1616ec43033cedbe343b6579e9921e2d898 in mainline linux
---

diff --git a/sys/dev/pci/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c b/sys/dev/pci/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c
index e2bcd205aa9..8da97a96b1c 100644
--- a/sys/dev/pci/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c
+++ b/sys/dev/pci/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c
@@ -304,6 +304,16 @@ void dcn302_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p
 			dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
 		}
 
+		/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
+		 * MAX_NUM_DPM_LVL is 8.
+		 * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
+		 * DC__VOLTAGE_STATES is 40.
+		 */
+		if (num_states > MAX_NUM_DPM_LVL) {
+			ASSERT(0);
+			return;
+		}
+
 		dcn3_02_soc.num_states = num_states;
 		for (i = 0; i < dcn3_02_soc.num_states; i++) {
 			dcn3_02_soc.clock_limits[i].state = i;
diff --git a/sys/dev/pci/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c b/sys/dev/pci/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c
index 3eb3a021ab7..c283780ad06 100644
--- a/sys/dev/pci/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c
+++ b/sys/dev/pci/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c
@@ -299,6 +299,16 @@ void dcn303_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p
 			dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
 		}
 
+		/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
+		 * MAX_NUM_DPM_LVL is 8.
+		 * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
+		 * DC__VOLTAGE_STATES is 40.
+		 */
+		if (num_states > MAX_NUM_DPM_LVL) {
+			ASSERT(0);
+			return;
+		}
+
 		dcn3_03_soc.num_states = num_states;
 		for (i = 0; i < dcn3_03_soc.num_states; i++) {
 			dcn3_03_soc.clock_limits[i].state = i;
diff --git a/sys/dev/pci/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/sys/dev/pci/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
index cf3b400c861..3d82cbef127 100644
--- a/sys/dev/pci/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
+++ b/sys/dev/pci/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
@@ -2885,6 +2885,16 @@ void dcn32_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_pa
 				dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
 			}
 
+			/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
+			 * MAX_NUM_DPM_LVL is 8.
+			 * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
+			 * DC__VOLTAGE_STATES is 40.
+			 */
+			if (num_states > MAX_NUM_DPM_LVL) {
+				ASSERT(0);
+				return;
+			}
+
 			dcn3_2_soc.num_states = num_states;
 			for (i = 0; i < dcn3_2_soc.num_states; i++) {
 				dcn3_2_soc.clock_limits[i].state = i;
diff --git a/sys/dev/pci/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c b/sys/dev/pci/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
index b26fcf86014..ae2196c36f2 100644
--- a/sys/dev/pci/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
+++ b/sys/dev/pci/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
@@ -789,6 +789,16 @@ void dcn321_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_p
 			dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
 		}
 
+		/* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
+		 * MAX_NUM_DPM_LVL is 8.
+		 * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
+		 * DC__VOLTAGE_STATES is 40.
+		 */
+		if (num_states > MAX_NUM_DPM_LVL) {
+			ASSERT(0);
+			return;
+		}
+
 		dcn3_21_soc.num_states = num_states;
 		for (i = 0; i < dcn3_21_soc.num_states; i++) {
 			dcn3_21_soc.clock_limits[i].state = i;