[AMD Official Use Only - General]
Ping
Best Regards,
Yifan
-----Original Message-----
From: Zhang, Yifan <Yifan1.Zhang@xxxxxxx>
Sent: Monday, December 12, 2022 8:40 PM
To: amd-gfx@xxxxxxxxxxxxxxxxxxxxx
Cc: Wentland, Harry <Harry.Wentland@xxxxxxx>; Liu, HaoPing (Alan) <HaoPing.Liu@xxxxxxx>; Zhang, Yifan <Yifan1.Zhang@xxxxxxx>
Subject: [PATCH] drm/amd/display: fix the crtc array out of bound issue.
adev->dm.dc->caps.max_links could be larger than AMDGPU_MAX_CRTCS,
change the iteration upper limit to AMDGPU_MAX_CRTCS to fix the issue.
[ 276.069644] ================================================================================
[ 276.069652] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_crc.c:550:55
[ 276.069660] index 6 is out of range for type 'amdgpu_crtc *[6]'
[ 276.069665] CPU: 11 PID: 1092 Comm: modprobe Tainted: G OE 5.19.0+ #15
Signed-off-by: Yifan Zhang <yifan1.zhang@xxxxxxx>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
index 8bf33fa4abd9..af2230797be9 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
@@ -217,7 +217,7 @@ int amdgpu_dm_crtc_configure_crc_source(struct drm_crtc *crtc, #if defined(CONFIG_DRM_AMD_SECURE_DISPLAY)
/* Disable secure_display if it was enabled */
if (!enable) {
- for (i = 0; i < adev->dm.dc->caps.max_links; i++) {
+ for (i = 0; i < AMDGPU_MAX_CRTCS; i++) {
if (adev->dm.secure_display_ctxs[i].crtc == crtc) {
/* stop ROI update on this crtc */
flush_work(&adev->dm.secure_display_ctxs[i].notify_ta_work);
@@ -543,7 +543,7 @@ amdgpu_dm_crtc_secure_display_create_contexts(struct amdgpu_device *adev)
if (!secure_display_ctxs)
return NULL;
- for (i = 0; i < adev->dm.dc->caps.max_links; i++) {
+ for (i = 0; i < AMDGPU_MAX_CRTCS; i++) {
INIT_WORK(&secure_display_ctxs[i].forward_roi_work, amdgpu_dm_forward_crc_window);
INIT_WORK(&secure_display_ctxs[i].notify_ta_work, amdgpu_dm_crtc_notify_ta_to_read);
secure_display_ctxs[i].crtc = &adev->mode_info.crtcs[i]->base;
--
2.37.3
