[AMD Official Use Only - General]
Reviewed-by: Alan Liu <haoping....@amd.com>
Thanks,
Alan
-----Original Message-----
From: Mahfooz, Hamza <hamza.mahf...@amd.com>
Sent: Thursday, January 12, 2023 2:17 AM
To: amd-gfx@lists.freedesktop.org
Cc: Mahfooz, Hamza <hamza.mahf...@amd.com>; Wentland, Harry
<harry.wentl...@amd.com>; Li, Sun peng (Leo) <sunpeng...@amd.com>; Siqueira,
Rodrigo <rodrigo.sique...@amd.com>; Deucher, Alexander
<alexander.deuc...@amd.com>; Koenig, Christian <christian.koe...@amd.com>; Pan,
Xinhui <xinhui....@amd.com>; David Airlie <airl...@gmail.com>; Daniel Vetter
<dan...@ffwll.ch>; Lin, Wayne <wayne....@amd.com>; Pillai, Aurabindo
<aurabindo.pil...@amd.com>; Li, Roman <roman...@amd.com>; Wu, Hersen
<hersenxs...@amd.com>; Zuo, Jerry <jerry....@amd.com>; Liu, HaoPing (Alan)
<haoping....@amd.com>; Dhillon, Jasdeep <jasdeep.dhil...@amd.com>; Liu, Aaron
<aaron....@amd.com>; dri-de...@lists.freedesktop.org;
linux-ker...@vger.kernel.org
Subject: [PATCH] drm/amd/display: fix possible buffer overflow relating to
secure display
It is possible that adev->dm.dc->caps.max_links is greater than
AMDGPU_MAX_CRTCS. So, to not potentially access unallocated memory use
adev->mode_info.num_crtc to do the bounds check instead of
adev->dm.dc->caps.max_links.
Fixes: 278b2b5ba2f2 ("drm/amd/display: Implement multiple secure display")
Fixes: 65a2fbe75cd5 ("drm/amd/display: Fix when disabling secure_display")
Signed-off-by: Hamza Mahfooz <hamza.mahf...@amd.com>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 8 +++++---
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index b4d60eedbcbf..86a268cc4b21 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1742,7 +1742,7 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev)
#if defined(CONFIG_DRM_AMD_SECURE_DISPLAY)
if (adev->dm.secure_display_ctxs) {
- for (i = 0; i < adev->dm.dc->caps.max_links; i++) {
+ for (i = 0; i < adev->mode_info.num_crtc; i++) {
if (adev->dm.secure_display_ctxs[i].crtc) {
flush_work(&adev->dm.secure_display_ctxs[i].notify_ta_work);
flush_work(&adev->dm.secure_display_ctxs[i].forward_roi_work);
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
index 8841c447d0e2..8873ecada27c 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
@@ -223,7 +223,7 @@ int amdgpu_dm_crtc_configure_crc_source(struct drm_crtc
*crtc, #if defined(CONFIG_DRM_AMD_SECURE_DISPLAY)
/* Disable secure_display if it was enabled */
if (!enable) {
- for (i = 0; i < adev->dm.dc->caps.max_links; i++) {
+ for (i = 0; i < adev->mode_info.num_crtc; i++) {
if (adev->dm.secure_display_ctxs[i].crtc ==
crtc) {
/* stop ROI update on this crtc */
flush_work(&adev->dm.secure_display_ctxs[i].notify_ta_work);
@@ -544,12 +544,14 @@ amdgpu_dm_crtc_secure_display_create_contexts(struct
amdgpu_device *adev)
struct secure_display_context *secure_display_ctxs = NULL;
int i;
- secure_display_ctxs = kcalloc(AMDGPU_MAX_CRTCS, sizeof(struct
secure_display_context), GFP_KERNEL);
+ secure_display_ctxs = kcalloc(adev->mode_info.num_crtc,
+ sizeof(struct secure_display_context),
+ GFP_KERNEL);
if (!secure_display_ctxs)
return NULL;
- for (i = 0; i < adev->dm.dc->caps.max_links; i++) {
+ for (i = 0; i < adev->mode_info.num_crtc; i++) {
INIT_WORK(&secure_display_ctxs[i].forward_roi_work,
amdgpu_dm_forward_crc_window);
INIT_WORK(&secure_display_ctxs[i].notify_ta_work,
amdgpu_dm_crtc_notify_ta_to_read);
secure_display_ctxs[i].crtc = &adev->mode_info.crtcs[i]->base;
--
2.38.1
