From b18ac6f10fcbfa14ff8353e0ebe2f45b161ae2e1 Mon Sep 17 00:00:00 2001 From: jsg Date: Mon, 4 Mar 2024 02:32:03 +0000 Subject: [PATCH] drm/amd/display: Fix buffer overflow in 'get_host_router_total_dp_tunnel_bw()' From Srinivasan Shanmugam 7211800091a9e2d49ad34f59d47321ca09ae30a7 in linux-6.6.y/6.6.19 97cba232549b9fe7e491fb60a69cf93075015f29 in mainline linux --- sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c b/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c index 7a6e42bde29..3db9489c08f 100644 --- a/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c +++ b/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c @@ -196,7 +196,7 @@ static int get_host_router_total_dp_tunnel_bw(const struct dc *dc, uint8_t hr_in struct dc_link *link_dpia_primary, *link_dpia_secondary; int total_bw = 0; - for (uint8_t i = 0; i < MAX_PIPES * 2; ++i) { + for (uint8_t i = 0; i < (MAX_PIPES * 2) - 1; ++i) { if (!dc->links[i] || dc->links[i]->ep_type != DISPLAY_ENDPOINT_USB4_DPIA) continue; -- 2.20.1