From: jsg <jsg@openbsd.org>
Date: Mon, 4 Mar 2024 02:32:03 +0000 (+0000)
Subject: drm/amd/display: Fix buffer overflow in 'get_host_router_total_dp_tunnel_bw()'
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=b18ac6f10fcbfa14ff8353e0ebe2f45b161ae2e1;p=openbsd

drm/amd/display: Fix buffer overflow in 'get_host_router_total_dp_tunnel_bw()'

From Srinivasan Shanmugam
7211800091a9e2d49ad34f59d47321ca09ae30a7 in linux-6.6.y/6.6.19
97cba232549b9fe7e491fb60a69cf93075015f29 in mainline linux
---

diff --git a/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c b/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
index 7a6e42bde29..3db9489c08f 100644
--- a/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
+++ b/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
@@ -196,7 +196,7 @@ static int get_host_router_total_dp_tunnel_bw(const struct dc *dc, uint8_t hr_in
 	struct dc_link *link_dpia_primary, *link_dpia_secondary;
 	int total_bw = 0;
 
-	for (uint8_t i = 0; i < MAX_PIPES * 2; ++i) {
+	for (uint8_t i = 0; i < (MAX_PIPES * 2) - 1; ++i) {
 
 		if (!dc->links[i] || dc->links[i]->ep_type != DISPLAY_ENDPOINT_USB4_DPIA)
 			continue;