Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
drm/amdgpu/gmc9.0: add bounds checking for cid
The value should never exceed the array size as those
are the only values the hardware is expected to return,
but add checks anyway.
Cc: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit e14d468304832bcc4a082d95849bc0a41b18ddea)
Cc: stable@vger.kernel.org
+14
-7
+14
-7
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+14
-7
drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
···
662
662
} else {
663
663
switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
664
664
case IP_VERSION(9, 0, 0):
665
-
mmhub_cid = mmhub_client_ids_vega10[cid][rw];
665
+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega10) ?
666
+
mmhub_client_ids_vega10[cid][rw] : NULL;
666
667
break;
667
668
case IP_VERSION(9, 3, 0):
668
-
mmhub_cid = mmhub_client_ids_vega12[cid][rw];
669
+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega12) ?
670
+
mmhub_client_ids_vega12[cid][rw] : NULL;
669
671
break;
670
672
case IP_VERSION(9, 4, 0):
671
-
mmhub_cid = mmhub_client_ids_vega20[cid][rw];
673
+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega20) ?
674
+
mmhub_client_ids_vega20[cid][rw] : NULL;
672
675
break;
673
676
case IP_VERSION(9, 4, 1):
674
-
mmhub_cid = mmhub_client_ids_arcturus[cid][rw];
677
+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_arcturus) ?
678
+
mmhub_client_ids_arcturus[cid][rw] : NULL;
675
679
break;
676
680
case IP_VERSION(9, 1, 0):
677
681
case IP_VERSION(9, 2, 0):
678
-
mmhub_cid = mmhub_client_ids_raven[cid][rw];
682
+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_raven) ?
683
+
mmhub_client_ids_raven[cid][rw] : NULL;
679
684
break;
680
685
case IP_VERSION(1, 5, 0):
681
686
case IP_VERSION(2, 4, 0):
682
-
mmhub_cid = mmhub_client_ids_renoir[cid][rw];
687
+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_renoir) ?
688
+
mmhub_client_ids_renoir[cid][rw] : NULL;
683
689
break;
684
690
case IP_VERSION(1, 8, 0):
685
691
case IP_VERSION(9, 4, 2):
686
-
mmhub_cid = mmhub_client_ids_aldebaran[cid][rw];
692
+
mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_aldebaran) ?
693
+
mmhub_client_ids_aldebaran[cid][rw] : NULL;
687
694
break;
688
695
default:
689
696
mmhub_cid = NULL;