[Public]
Reviewed-by: Roman Li <roman.li@xxxxxxx>
> -----Original Message-----
> From: SHANMUGAM, SRINIVASAN <SRINIVASAN.SHANMUGAM@xxxxxxx>
> Sent: Wednesday, October 9, 2024 10:25 AM
> To: Siqueira, Rodrigo <Rodrigo.Siqueira@xxxxxxx>; Pillai, Aurabindo
> <Aurabindo.Pillai@xxxxxxx>
> Cc: amd-gfx@xxxxxxxxxxxxxxxxxxxxx; SHANMUGAM, SRINIVASAN
> <SRINIVASAN.SHANMUGAM@xxxxxxx>; Chung, ChiaHsuan (Tom)
> <ChiaHsuan.Chung@xxxxxxx>; Li, Roman <Roman.Li@xxxxxxx>; Hung, Alex
> <Alex.Hung@xxxxxxx>; Wentland, Harry <Harry.Wentland@xxxxxxx>; Mahfooz,
> Hamza <Hamza.Mahfooz@xxxxxxx>
> Subject: [PATCH] drm/amd/display: Add hpd_source index out-of-bounds check for
> dcn3x link encoder creation
>
> This patch adds a boundary check for the hpd_source index during the link encoder
> creation process for dcn3x IP's. The check ensures that the index is within the valid
> range of the link_enc_hpd_regs array to prevent out-of-bounds access.
>
> Cc: Tom Chung <chiahsuan.chung@xxxxxxx>
> Cc: Rodrigo Siqueira <Rodrigo.Siqueira@xxxxxxx>
> Cc: Roman Li <roman.li@xxxxxxx>
> Cc: Alex Hung <alex.hung@xxxxxxx>
> Cc: Aurabindo Pillai <aurabindo.pillai@xxxxxxx>
> Cc: Harry Wentland <harry.wentland@xxxxxxx>
> Cc: Hamza Mahfooz <hamza.mahfooz@xxxxxxx>
> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@xxxxxxx>
> ---
> drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c | 2 +-
> .../gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c | 2 +-
> .../gpu/drm/amd/display/dc/resource/dcn302/dcn302_resource.c | 2 +-
> .../gpu/drm/amd/display/dc/resource/dcn303/dcn303_resource.c | 2 +-
> drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c | 2 +-
> .../gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c | 2 +-
> .../gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c | 2 +-
> .../gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c | 2 +-
> drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c | 2 +-
> .../gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c | 2 +-
> drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c | 2 +-
> .../gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c | 2 +-
> 12 files changed, 12 insertions(+), 12 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c
> index 5040a4c6ed18..baa4e2647dad 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn30/dcn30_resource.c
> @@ -927,7 +927,7 @@ static struct link_encoder *dcn30_link_encoder_create(
> struct dcn20_link_encoder *enc20 =
> kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
>
> - if (!enc20)
> + if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
> return NULL;
>
> dcn30_link_encoder_construct(enc20,
> diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
> index 7d04739c3ba1..d8a7c2cf05de 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
> @@ -883,7 +883,7 @@ static struct link_encoder *dcn301_link_encoder_create(
> struct dcn20_link_encoder *enc20 =
> kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
>
> - if (!enc20)
> + if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
> return NULL;
>
> dcn301_link_encoder_construct(enc20,
> diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn302/dcn302_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn302/dcn302_resource.c
> index 5791b5cc2875..40c20b04635a 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn302/dcn302_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn302/dcn302_resource.c
> @@ -893,7 +893,7 @@ static struct link_encoder *dcn302_link_encoder_create( {
> struct dcn20_link_encoder *enc20 = kzalloc(sizeof(struct
> dcn20_link_encoder), GFP_KERNEL);
>
> - if (!enc20)
> + if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
> return NULL;
>
> dcn30_link_encoder_construct(enc20, enc_init_data, &link_enc_feature, diff
> --git a/drivers/gpu/drm/amd/display/dc/resource/dcn303/dcn303_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn303/dcn303_resource.c
> index 63f0f882c861..daf1b65fd088 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn303/dcn303_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn303/dcn303_resource.c
> @@ -839,7 +839,7 @@ static struct link_encoder *dcn303_link_encoder_create( {
> struct dcn20_link_encoder *enc20 = kzalloc(sizeof(struct
> dcn20_link_encoder), GFP_KERNEL);
>
> - if (!enc20)
> + if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
> return NULL;
>
> dcn30_link_encoder_construct(enc20, enc_init_data, &link_enc_feature, diff
> --git a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
> index ac8cb20e2e3b..36bb26182e11 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn31/dcn31_resource.c
> @@ -1093,7 +1093,7 @@ static struct link_encoder *dcn31_link_encoder_create(
> struct dcn20_link_encoder *enc20 =
> kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
>
> - if (!enc20)
> + if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
> return NULL;
>
> dcn31_link_encoder_construct(enc20,
> diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
> index 169924d0a839..58a5fbcf22bf 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
> @@ -1149,7 +1149,7 @@ static struct link_encoder *dcn31_link_encoder_create(
> struct dcn20_link_encoder *enc20 =
> kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
>
> - if (!enc20)
> + if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
> return NULL;
>
> dcn31_link_encoder_construct(enc20,
> diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c
> index f6b840f046a5..3acad708c31b 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c
> @@ -1091,7 +1091,7 @@ static struct link_encoder *dcn31_link_encoder_create(
> struct dcn20_link_encoder *enc20 =
> kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
>
> - if (!enc20)
> + if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
> return NULL;
>
> dcn31_link_encoder_construct(enc20,
> diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c
> index 5fd52c5fcee4..ce56f5d162c0 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c
> @@ -1085,7 +1085,7 @@ static struct link_encoder *dcn31_link_encoder_create(
> struct dcn20_link_encoder *enc20 =
> kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
>
> - if (!enc20)
> + if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
> return NULL;
>
> dcn31_link_encoder_construct(enc20,
> diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
> index a124ad9bd108..a1890df29f5c 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
> @@ -1039,7 +1039,7 @@ static struct link_encoder *dcn32_link_encoder_create(
> struct dcn20_link_encoder *enc20 =
> kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
>
> - if (!enc20)
> + if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
> return NULL;
>
> #undef REG_STRUCT
> diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c
> index 827a94f84f10..35acc13cb5a9 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c
> @@ -1035,7 +1035,7 @@ static struct link_encoder
> *dcn321_link_encoder_create(
> struct dcn20_link_encoder *enc20 =
> kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
>
> - if (!enc20)
> + if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
> return NULL;
>
> #undef REG_STRUCT
> diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
> index 893a9d9ee870..795f2c71c70f 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
> @@ -1074,7 +1074,7 @@ static struct link_encoder *dcn35_link_encoder_create(
> struct dcn20_link_encoder *enc20 =
> kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
>
> - if (!enc20)
> + if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
> return NULL;
>
> #undef REG_STRUCT
> diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c
> b/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c
> index 70abd32ce2ad..0b8dc2eff596 100644
> --- a/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c
> +++ b/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c
> @@ -1054,7 +1054,7 @@ static struct link_encoder *dcn35_link_encoder_create(
> struct dcn20_link_encoder *enc20 =
> kzalloc(sizeof(struct dcn20_link_encoder), GFP_KERNEL);
>
> - if (!enc20)
> + if (!enc20 || enc_init_data->hpd_source >=
> +ARRAY_SIZE(link_enc_hpd_regs))
> return NULL;
>
> #undef REG_STRUCT
> --
> 2.34.1
