[AMD Official Use Only - General] Ping
Best Regards, Yifan -----Original Message----- From: Zhang, Yifan <[email protected]> Sent: Monday, December 12, 2022 8:40 PM To: [email protected] Cc: Wentland, Harry <[email protected]>; Liu, HaoPing (Alan) <[email protected]>; Zhang, Yifan <[email protected]> Subject: [PATCH] drm/amd/display: fix the crtc array out of bound issue. adev->dm.dc->caps.max_links could be larger than AMDGPU_MAX_CRTCS, change the iteration upper limit to AMDGPU_MAX_CRTCS to fix the issue. [ 276.069644] ================================================================================ [ 276.069652] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_crc.c:550:55 [ 276.069660] index 6 is out of range for type 'amdgpu_crtc *[6]' [ 276.069665] CPU: 11 PID: 1092 Comm: modprobe Tainted: G OE 5.19.0+ #15 Signed-off-by: Yifan Zhang <[email protected]> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c index 8bf33fa4abd9..af2230797be9 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c @@ -217,7 +217,7 @@ int amdgpu_dm_crtc_configure_crc_source(struct drm_crtc *crtc, #if defined(CONFIG_DRM_AMD_SECURE_DISPLAY) /* Disable secure_display if it was enabled */ if (!enable) { - for (i = 0; i < adev->dm.dc->caps.max_links; i++) { + for (i = 0; i < AMDGPU_MAX_CRTCS; i++) { if (adev->dm.secure_display_ctxs[i].crtc == crtc) { /* stop ROI update on this crtc */ flush_work(&adev->dm.secure_display_ctxs[i].notify_ta_work); @@ -543,7 +543,7 @@ amdgpu_dm_crtc_secure_display_create_contexts(struct amdgpu_device *adev) if (!secure_display_ctxs) return NULL; - for (i = 0; i < adev->dm.dc->caps.max_links; i++) { + for (i = 0; i < AMDGPU_MAX_CRTCS; i++) { INIT_WORK(&secure_display_ctxs[i].forward_roi_work, amdgpu_dm_forward_crc_window); INIT_WORK(&secure_display_ctxs[i].notify_ta_work, amdgpu_dm_crtc_notify_ta_to_read); secure_display_ctxs[i].crtc = &adev->mode_info.crtcs[i]->base; -- 2.37.3
