diff options
| author | Alex Hung <[email protected]> | 2024-04-22 18:07:17 -0600 |
|---|---|---|
| committer | Alex Deucher <[email protected]> | 2024-04-26 17:22:44 -0400 |
| commit | 5396a70e8cf462ec5ccf2dc8de103c79de9489e6 (patch) | |
| tree | 1ca335594a932851d4566f6642164dec16210e87 | |
| parent | bd31e5026dc39e7ca46ffb763c513130f405b1a8 (diff) | |
drm/amd/display: Check pipe offset before setting vblank
pipe_ctx has a size of MAX_PIPES so checking its index before accessing
the array.
This fixes an OVERRUN issue reported by Coverity.
Reviewed-by: Rodrigo Siqueira <[email protected]>
Acked-by: Wayne Lin <[email protected]>
Signed-off-by: Alex Hung <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
| -rw-r--r-- | drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c b/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c index 1c0d89e675da..bb576a9c5fdb 100644 --- a/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c +++ b/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c @@ -211,8 +211,12 @@ bool dce110_vblank_set(struct irq_service *irq_service, info->ext_id); uint8_t pipe_offset = dal_irq_src - IRQ_TYPE_VBLANK; - struct timing_generator *tg = - dc->current_state->res_ctx.pipe_ctx[pipe_offset].stream_res.tg; + struct timing_generator *tg; + + if (pipe_offset >= MAX_PIPES) + return false; + + tg = dc->current_state->res_ctx.pipe_ctx[pipe_offset].stream_res.tg; if (enable) { if (!tg || !tg->funcs->arm_vert_intr(tg, 2)) { |