From c3d749609472ba0b217b42ab66f80459847e2bcb Mon Sep 17 00:00:00 2001 From: Hamza Mahfooz Date: Wed, 11 Jan 2023 12:25:14 -0500 Subject: drm/amd/display: fix possible buffer overflow relating to secure display It is possible that adev->dm.dc->caps.max_links is greater than AMDGPU_MAX_CRTCS. So, to not potentially access unallocated memory use adev->mode_info.num_crtc to do the bounds check instead of adev->dm.dc->caps.max_links. Fixes: 1b11ff764aef ("drm/amd/display: Implement multiple secure display") Fixes: b8ff7e08bab9 ("drm/amd/display: Fix when disabling secure_display") Reviewed-by: Alan Liu Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c') diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index b4197b5f51fb..247e783d32ae 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -1741,7 +1741,7 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev) #if defined(CONFIG_DRM_AMD_SECURE_DISPLAY) if (adev->dm.secure_display_ctxs) { - for (i = 0; i < adev->dm.dc->caps.max_links; i++) { + for (i = 0; i < adev->mode_info.num_crtc; i++) { if (adev->dm.secure_display_ctxs[i].crtc) { flush_work(&adev->dm.secure_display_ctxs[i].notify_ta_work); flush_work(&adev->dm.secure_display_ctxs[i].forward_roi_work); -- cgit