diff options
| author | Alex Hung <alex.hung@amd.com> | 2024-04-22 18:07:17 -0600 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2024-04-26 17:22:44 -0400 |
| commit | 5396a70e8cf462ec5ccf2dc8de103c79de9489e6 (patch) | |
| tree | 1ca335594a932851d4566f6642164dec16210e87 /drivers/gpu/drm/amd | |
| parent | bd31e5026dc39e7ca46ffb763c513130f405b1a8 (diff) | |
| download | linux-stable-5396a70e8cf462ec5ccf2dc8de103c79de9489e6.tar.gz linux-stable-5396a70e8cf462ec5ccf2dc8de103c79de9489e6.tar.bz2 linux-stable-5396a70e8cf462ec5ccf2dc8de103c79de9489e6.zip | |
drm/amd/display: Check pipe offset before setting vblank
pipe_ctx has a size of MAX_PIPES so checking its index before accessing
the array.
This fixes an OVERRUN issue reported by Coverity.
Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
Acked-by: Wayne Lin <wayne.lin@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd')
| -rw-r--r-- | drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c b/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c index 1c0d89e675da..bb576a9c5fdb 100644 --- a/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c +++ b/drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c @@ -211,8 +211,12 @@ bool dce110_vblank_set(struct irq_service *irq_service, info->ext_id); uint8_t pipe_offset = dal_irq_src - IRQ_TYPE_VBLANK; - struct timing_generator *tg = - dc->current_state->res_ctx.pipe_ctx[pipe_offset].stream_res.tg; + struct timing_generator *tg; + + if (pipe_offset >= MAX_PIPES) + return false; + + tg = dc->current_state->res_ctx.pipe_ctx[pipe_offset].stream_res.tg; if (enable) { if (!tg || !tg->funcs->arm_vert_intr(tg, 2)) { |