diff options
| author | Alex Hung <[email protected]> | 2024-04-25 18:37:58 -0600 |
|---|---|---|
| committer | Alex Deucher <[email protected]> | 2024-05-02 16:18:18 -0400 |
| commit | 55ec7679e6a5f67d2831b87a24fe2d5066311fdd (patch) | |
| tree | acbe6589eb00d38404a0810b24c9485f4da4d3b9 | |
| parent | ae13c8a5cff92015b9a3eb7cee65ebc75859487f (diff) | |
drm/amd/display: Limit array index according to architecture
[WHY & HOW]
ctx->architecture determine array sizes of ODMMode and DPPPerSurface
arrays to __DML2_WRAPPER_MAX_STREAMS_PLANES__ or __DML_NUM_PLANES__,
and these array index should be checked before used
This fixes 2 OVERRUN issues reported by Coverity.
Reviewed-by: Harry Wentland <[email protected]>
Acked-by: Tom Chung <[email protected]>
Signed-off-by: Alex Hung <[email protected]>
Tested-by: Daniel Wheeler <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
| -rw-r--r-- | drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c b/drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c index 507cff525f97..49e2cc65a43b 100644 --- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c +++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c @@ -1031,6 +1031,7 @@ bool dml2_map_dc_pipes(struct dml2_context *ctx, struct dc_state *state, const s unsigned int stream_disp_cfg_index; unsigned int plane_disp_cfg_index; + unsigned int disp_cfg_index_max; unsigned int plane_id; unsigned int stream_id; @@ -1060,6 +1061,7 @@ bool dml2_map_dc_pipes(struct dml2_context *ctx, struct dc_state *state, const s } else { ODMMode = (unsigned int *)disp_cfg->hw.ODMMode; DPPPerSurface = disp_cfg->hw.DPPPerSurface; + disp_cfg_index_max = __DML_NUM_PLANES__; } for (stream_index = 0; stream_index < state->stream_count; stream_index++) { @@ -1067,6 +1069,8 @@ bool dml2_map_dc_pipes(struct dml2_context *ctx, struct dc_state *state, const s stream_id = state->streams[stream_index]->stream_id; stream_disp_cfg_index = find_disp_cfg_idx_by_stream_id(mapping, stream_id); + if (stream_disp_cfg_index >= disp_cfg_index_max) + continue; if (ODMMode[stream_disp_cfg_index] == dml_odm_mode_bypass) { scratch.odm_info.odm_factor = 1; @@ -1110,7 +1114,7 @@ bool dml2_map_dc_pipes(struct dml2_context *ctx, struct dc_state *state, const s // Setup mpc_info for this plane scratch.mpc_info.prev_odm_pipe = NULL; - if (scratch.odm_info.odm_factor == 1) { + if (scratch.odm_info.odm_factor == 1 && plane_disp_cfg_index < disp_cfg_index_max) { // If ODM combine is not inuse, then the number of pipes // per plane is determined by MPC combine factor scratch.mpc_info.mpc_factor = DPPPerSurface[plane_disp_cfg_index]; |