[PATCH 08/15] drm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr

[Aurabindo Pillai]

From: Roman Li <roman...@amd.com>

[Why]
There is a potential memory access violation while
iterating through array of dcn35 clks.

[How]
Limit iteration per array size.

Reviewed-by: Nicholas Kazlauskas <nicholas.kazlaus...@amd.com>
Acked-by: Aurabindo Pillai <aurabindo.pil...@amd.com>
Signed-off-by: Roman Li <roman...@amd.com>
---
 .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c  | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c 
b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
index 36e5bb611fb1..c378b879c76d 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c
@@ -658,10 +658,13 @@ static void 
dcn35_clk_mgr_helper_populate_bw_params(struct clk_mgr_internal *clk
        struct clk_limit_table_entry def_max = 
bw_params->clk_table.entries[bw_params->clk_table.num_entries - 1];
        uint32_t max_fclk = 0, min_pstate = 0, max_dispclk = 0, max_dppclk = 0;
        uint32_t max_pstate = 0, max_dram_speed_mts = 0, min_dram_speed_mts = 0;
+       uint32_t num_memps, num_fclk, num_dcfclk;
        int i;
 
        /* Determine min/max p-state values. */
-       for (i = 0; i < clock_table->NumMemPstatesEnabled; i++) {
+       num_memps = (clock_table->NumMemPstatesEnabled > NUM_MEM_PSTATE_LEVELS) 
? NUM_MEM_PSTATE_LEVELS :
+               clock_table->NumMemPstatesEnabled;
+       for (i = 0; i < num_memps; i++) {
                uint32_t dram_speed_mts = 
calc_dram_speed_mts(&clock_table->MemPstateTable[i]);
 
                if (is_valid_clock_value(dram_speed_mts) && dram_speed_mts > 
max_dram_speed_mts) {
@@ -673,7 +676,7 @@ static void dcn35_clk_mgr_helper_populate_bw_params(struct 
clk_mgr_internal *clk
        min_dram_speed_mts = max_dram_speed_mts;
        min_pstate = max_pstate;
 
-       for (i = 0; i < clock_table->NumMemPstatesEnabled; i++) {
+       for (i = 0; i < num_memps; i++) {
                uint32_t dram_speed_mts = 
calc_dram_speed_mts(&clock_table->MemPstateTable[i]);
 
                if (is_valid_clock_value(dram_speed_mts) && dram_speed_mts < 
min_dram_speed_mts) {
@@ -702,9 +705,13 @@ static void dcn35_clk_mgr_helper_populate_bw_params(struct 
clk_mgr_internal *clk
        /* Base the clock table on dcfclk, need at least one entry regardless 
of pmfw table */
        ASSERT(clock_table->NumDcfClkLevelsEnabled > 0);
 
-       max_fclk = find_max_clk_value(clock_table->FclkClocks_Freq, 
clock_table->NumFclkLevelsEnabled);
+       num_fclk = (clock_table->NumFclkLevelsEnabled > NUM_FCLK_DPM_LEVELS) ? 
NUM_FCLK_DPM_LEVELS :
+               clock_table->NumFclkLevelsEnabled;
+       max_fclk = find_max_clk_value(clock_table->FclkClocks_Freq, num_fclk);
 
-       for (i = 0; i < clock_table->NumDcfClkLevelsEnabled; i++) {
+       num_dcfclk = (clock_table->NumFclkLevelsEnabled > 
NUM_DCFCLK_DPM_LEVELS) ? NUM_DCFCLK_DPM_LEVELS :
+               clock_table->NumDcfClkLevelsEnabled;
+       for (i = 0; i < num_dcfclk; i++) {
                int j;
 
                /* First search defaults for the clocks we don't read using 
closest lower or equal default dcfclk */
-- 
2.43.0