]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commitdiff
drm/amd/display: Guard against invalid array access
authorAric Cyr <aric.cyr@amd.com>
Wed, 13 May 2020 03:36:05 +0000 (23:36 -0400)
committerAlex Deucher <alexander.deucher@amd.com>
Thu, 28 May 2020 18:00:51 +0000 (14:00 -0400)
[Why]
There are scenarios where no OPP is assigned to an OTG so its value is
0xF which is outside the size of the OPP array causing a potential
driver crash.

[How]
Change the assert to an early return to guard against access.  If
there's no OPP assigned already, then OTG will be blank anyways so no
functionality should be lost.

Signed-off-by: Aric Cyr <aric.cyr@amd.com>
Reviewed-by: Zhan Liu <Zhan.Liu@amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c

index 26cac587c56b3f311df7859c5061ccb22658951e..223e314d26b4db6285db57d43c10eacac32d245a 100644 (file)
@@ -291,12 +291,20 @@ void dcn20_init_blank(
 
        /* get the OPTC source */
        tg->funcs->get_optc_source(tg, &num_opps, &opp_id_src0, &opp_id_src1);
-       ASSERT(opp_id_src0 < dc->res_pool->res_cap->num_opp);
+
+       if (opp_id_src0 >= dc->res_pool->res_cap->num_opp) {
+               ASSERT(false);
+               return;
+       }
        opp = dc->res_pool->opps[opp_id_src0];
 
        if (num_opps == 2) {
                otg_active_width = otg_active_width / 2;
-               ASSERT(opp_id_src1 < dc->res_pool->res_cap->num_opp);
+
+               if (opp_id_src1 >= dc->res_pool->res_cap->num_opp) {
+                       ASSERT(false);
+                       return;
+               }
                bottom_opp = dc->res_pool->opps[opp_id_src1];
        }