Patch "drm/amd/display: Fix potential index out of bounds in color transformation function" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    drm/amd/display: Fix potential index out of bounds in color transformation function

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-amd-display-fix-potential-index-out-of-bounds-in.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 904c45d31b77a1f3f5463da3b449f0aa85673526
Author: Srinivasan Shanmugam <srinivasan.shanmugam@xxxxxxx>
Date:   Mon Feb 26 18:38:08 2024 +0530

    drm/amd/display: Fix potential index out of bounds in color transformation function
    
    [ Upstream commit 63ae548f1054a0b71678d0349c7dc9628ddd42ca ]
    
    Fixes index out of bounds issue in the color transformation function.
    The issue could occur when the index 'i' exceeds the number of transfer
    function points (TRANSFER_FUNC_POINTS).
    
    The fix adds a check to ensure 'i' is within bounds before accessing the
    transfer function points. If 'i' is out of bounds, an error message is
    logged and the function returns false to indicate an error.
    
    Reported by smatch:
    drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max
    drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max
    drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
    
    Fixes: b629596072e5 ("drm/amd/display: Build unity lut for shaper")
    Cc: Vitaly Prosyak <vitaly.prosyak@xxxxxxx>
    Cc: Charlene Liu <Charlene.Liu@xxxxxxx>
    Cc: Harry Wentland <harry.wentland@xxxxxxx>
    Cc: Rodrigo Siqueira <Rodrigo.Siqueira@xxxxxxx>
    Cc: Roman Li <roman.li@xxxxxxx>
    Cc: Aurabindo Pillai <aurabindo.pillai@xxxxxxx>
    Cc: Tom Chung <chiahsuan.chung@xxxxxxx>
    Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@xxxxxxx>
    Reviewed-by: Tom Chung <chiahsuan.chung@xxxxxxx>
    Signed-off-by: Alex Deucher <alexander.deucher@xxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
index 3538973bd0c6c..c0372aa4ec838 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
@@ -382,6 +382,11 @@ bool cm_helper_translate_curve_to_hw_format(struct dc_context *ctx,
 				i += increment) {
 			if (j == hw_points - 1)
 				break;
+			if (i >= TRANSFER_FUNC_POINTS) {
+				DC_LOG_ERROR("Index out of bounds: i=%d, TRANSFER_FUNC_POINTS=%d\n",
+					     i, TRANSFER_FUNC_POINTS);
+				return false;
+			}
 			rgb_resulted[j].red = output_tf->tf_pts.red[i];
 			rgb_resulted[j].green = output_tf->tf_pts.green[i];
 			rgb_resulted[j].blue = output_tf->tf_pts.blue[i];