Patch "drm/amd/display: Guard against invalid RPTR/WPTR being set" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    drm/amd/display: Guard against invalid RPTR/WPTR being set

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-amd-display-guard-against-invalid-rptr-wptr-bein.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit fcf2e91100e8a324ce35013028fc94e429898425
Author: Nicholas Kazlauskas <nicholas.kazlauskas@xxxxxxx>
Date:   Wed Sep 13 16:18:44 2023 -0400

    drm/amd/display: Guard against invalid RPTR/WPTR being set
    
    [ Upstream commit 1ffa8602e39b89469dc703ebab7a7e44c33da0f7 ]
    
    [WHY]
    HW can return invalid values on register read, guard against these being
    set and causing us to access memory out of range and page fault.
    
    [HOW]
    Guard at sync_inbox1 and guard at pushing commands.
    
    Cc: Mario Limonciello <mario.limonciello@xxxxxxx>
    Cc: Alex Deucher <alexander.deucher@xxxxxxx>
    Cc: stable@xxxxxxxxxxxxxxx
    Reviewed-by: Hansen Dsouza <hansen.dsouza@xxxxxxx>
    Acked-by: Alex Hung <alex.hung@xxxxxxx>
    Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@xxxxxxx>
    Tested-by: Daniel Wheeler <daniel.wheeler@xxxxxxx>
    Signed-off-by: Alex Deucher <alexander.deucher@xxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
index 6b8bd556c872f..e951fd837aa27 100644
--- a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
+++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
@@ -675,9 +675,16 @@ enum dmub_status dmub_srv_sync_inbox1(struct dmub_srv *dmub)
 		return DMUB_STATUS_INVALID;
 
 	if (dmub->hw_funcs.get_inbox1_rptr && dmub->hw_funcs.get_inbox1_wptr) {
-		dmub->inbox1_rb.rptr = dmub->hw_funcs.get_inbox1_rptr(dmub);
-		dmub->inbox1_rb.wrpt = dmub->hw_funcs.get_inbox1_wptr(dmub);
-		dmub->inbox1_last_wptr = dmub->inbox1_rb.wrpt;
+		uint32_t rptr = dmub->hw_funcs.get_inbox1_rptr(dmub);
+		uint32_t wptr = dmub->hw_funcs.get_inbox1_wptr(dmub);
+
+		if (rptr > dmub->inbox1_rb.capacity || wptr > dmub->inbox1_rb.capacity) {
+			return DMUB_STATUS_HW_FAILURE;
+		} else {
+			dmub->inbox1_rb.rptr = rptr;
+			dmub->inbox1_rb.wrpt = wptr;
+			dmub->inbox1_last_wptr = dmub->inbox1_rb.wrpt;
+		}
 	}
 
 	return DMUB_STATUS_OK;
@@ -711,6 +718,11 @@ enum dmub_status dmub_srv_cmd_queue(struct dmub_srv *dmub,
 	if (!dmub->hw_init)
 		return DMUB_STATUS_INVALID;
 
+	if (dmub->inbox1_rb.rptr > dmub->inbox1_rb.capacity ||
+	    dmub->inbox1_rb.wrpt > dmub->inbox1_rb.capacity) {
+		return DMUB_STATUS_HW_FAILURE;
+	}
+
 	if (dmub_rb_push_front(&dmub->inbox1_rb, cmd))
 		return DMUB_STATUS_OK;