diff options
| author | Alex Hung <alex.hung@amd.com> | 2024-04-23 03:07:17 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-07-11 13:49:05 +0300 |
| commit | 96bf81cc1bd058bb8af6e755a548e926e934dfd1 (patch) | |
| tree | f22705182206954f9ea61cf40eb31072cdb7fa30 | |
| parent | 9933eca6ada0cd612e19522e7a319bcef464c0eb (diff) | |
| download | linux-96bf81cc1bd058bb8af6e755a548e926e934dfd1.tar.xz | |
drm/amd/display: Check pipe offset before setting vblank
[ Upstream commit 5396a70e8cf462ec5ccf2dc8de103c79de9489e6 ]
pipe_ctx has a size of MAX_PIPES so checking its index before accessing
the array.
This fixes an OVERRUN issue reported by Coverity.
Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
Acked-by: Wayne Lin <wayne.lin@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c b/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c index 44649db5f3e3..5646b7788f02 100644 --- a/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c +++ b/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c @@ -211,8 +211,12 @@ bool dce110_vblank_set(struct irq_service *irq_service, info->ext_id); uint8_t pipe_offset = dal_irq_src - IRQ_TYPE_VBLANK; - struct timing_generator *tg = - dc->current_state->res_ctx.pipe_ctx[pipe_offset].stream_res.tg; + struct timing_generator *tg; + + if (pipe_offset >= MAX_PIPES) + return false; + + tg = dc->current_state->res_ctx.pipe_ctx[pipe_offset].stream_res.tg; if (enable) { if (!tg || !tg->funcs->arm_vert_intr(tg, 2)) { |