drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box

[Why]
Coverity reports OVERRUN warning. soc.num_states could
be 40. But array range of bw_params->clk_table.entries is 8.

[How]
Assert if soc.num_states greater than 8.

Reviewed-by: Alex Hung <alex.hung@amd.com>
Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Hersen Wu <hersenxs.wu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c
index e2bcd205aa936f3615197e40766bf27b0f5d4425..8da97a96b1ceb9bad9d7992ca4b60078af31b3fc 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c
@@ -304,6 +304,16 @@ void dcn302_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p
                        dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
                }
 
+               /* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
+                * MAX_NUM_DPM_LVL is 8.
+                * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
+                * DC__VOLTAGE_STATES is 40.
+                */
+               if (num_states > MAX_NUM_DPM_LVL) {
+                       ASSERT(0);
+                       return;
+               }
+
                dcn3_02_soc.num_states = num_states;
                for (i = 0; i < dcn3_02_soc.num_states; i++) {
                        dcn3_02_soc.clock_limits[i].state = i;

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c
index 3f02bb806d421a224401aa2bde415e564f453e8b..e968870a4b810c62e30114d7ba1c88e7dd2c9834 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c
@@ -310,6 +310,16 @@ void dcn303_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p
                        dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
                }
 
+               /* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
+                * MAX_NUM_DPM_LVL is 8.
+                * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
+                * DC__VOLTAGE_STATES is 40.
+                */
+               if (num_states > MAX_NUM_DPM_LVL) {
+                       ASSERT(0);
+                       return;
+               }
+
                dcn3_03_soc.num_states = num_states;
                for (i = 0; i < dcn3_03_soc.num_states; i++) {
                        dcn3_03_soc.clock_limits[i].state = i;

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
index d74f51efb7037b5ce2f35f71482abea35ee3b66b..7aba7112c8f8089e7b94e089e11a8afdfce4b85a 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
@@ -3232,6 +3232,16 @@ void dcn32_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_pa
                                dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
                        }
 
+                       /* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
+                        * MAX_NUM_DPM_LVL is 8.
+                        * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
+                        * DC__VOLTAGE_STATES is 40.
+                        */
+                       if (num_states > MAX_NUM_DPM_LVL) {
+                               ASSERT(0);
+                               return;
+                       }
+
                        dcn3_2_soc.num_states = num_states;
                        for (i = 0; i < dcn3_2_soc.num_states; i++) {
                                dcn3_2_soc.clock_limits[i].state = i;

diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
index ff4d795c79664b5dc726e2c4d6222400826ec4d1..4297402bdab393d3baa4a17d9197bcd2b0e7810c 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c
@@ -803,6 +803,16 @@ void dcn321_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_p
                        dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
                }
 
+               /* bw_params->clk_table.entries[MAX_NUM_DPM_LVL].
+                * MAX_NUM_DPM_LVL is 8.
+                * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES].
+                * DC__VOLTAGE_STATES is 40.
+                */
+               if (num_states > MAX_NUM_DPM_LVL) {
+                       ASSERT(0);
+                       return;
+               }
+
                dcn3_21_soc.num_states = num_states;
                for (i = 0; i < dcn3_21_soc.num_states; i++) {
                        dcn3_21_soc.clock_limits[i].state = i;