Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
drm/amdgpu/mmhub2.0: add bounds checking for cid
The value should never exceed the array size as those
are the only values the hardware is expected to return,
but add checks anyway.
Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit e064cef4b53552602bb6ac90399c18f662f3cacd)
Cc: stable@vger.kernel.org
+6
-3
+6
-3
drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
+6
-3
drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
···
154
154
switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
155
155
case IP_VERSION(2, 0, 0):
156
156
case IP_VERSION(2, 0, 2):
157
-
mmhub_cid = mmhub_client_ids_navi1x[cid][rw];
157
+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_navi1x) ?
158
+
mmhub_client_ids_navi1x[cid][rw] : NULL;
158
159
break;
159
160
case IP_VERSION(2, 1, 0):
160
161
case IP_VERSION(2, 1, 1):
161
-
mmhub_cid = mmhub_client_ids_sienna_cichlid[cid][rw];
162
+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_sienna_cichlid) ?
163
+
mmhub_client_ids_sienna_cichlid[cid][rw] : NULL;
162
164
break;
163
165
case IP_VERSION(2, 1, 2):
164
-
mmhub_cid = mmhub_client_ids_beige_goby[cid][rw];
166
+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_beige_goby) ?
167
+
mmhub_client_ids_beige_goby[cid][rw] : NULL;
165
168
break;
166
169
default:
167
170
mmhub_cid = NULL;