From: Hersen Wu <hersenxs...@amd.com>

[ Upstream commit cf8b16857db702ceb8d52f9219a4613363e2b1cf ]

[Why]
Coverity report OVERRUN warning. There are
only max_links elements within dc->links. link
count could up to AMDGPU_DM_MAX_DISPLAY_INDEX 31.

[How]
Make sure link count less than max_links.

Reviewed-by: Harry Wentland <harry.wentl...@amd.com>
Acked-by: Tom Chung <chiahsuan.ch...@amd.com>
Signed-off-by: Hersen Wu <hersenxs...@amd.com>
Tested-by: Daniel Wheeler <daniel.whee...@amd.com>
Signed-off-by: Alex Deucher <alexander.deuc...@amd.com>
[Minor conflict resolved due to code context change. And the macro MAX_LINKS
 is introduced by Commit 60df5628144b ("drm/amd/display: handle invalid
 connector indices") after 6.10. So here we still use the original array
 length MAX_PIPES * 2]
Signed-off-by: Jianqi Ren <jianqi.ren...@windriver.com>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c 
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index a33ca712a89c..b1f4d8a84e1b 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -4321,17 +4321,17 @@ static int amdgpu_dm_initialize_drm_device(struct 
amdgpu_device *adev)
        }
 #endif
 
+       if (link_cnt > (MAX_PIPES * 2)) {
+               DRM_ERROR(
+                       "KMS: Cannot support more than %d display indexes\n",
+                               MAX_PIPES * 2);
+               goto fail;
+       }
+
        /* loops over all connectors on the board */
        for (i = 0; i < link_cnt; i++) {
                struct dc_link *link = NULL;
 
-               if (i > AMDGPU_DM_MAX_DISPLAY_INDEX) {
-                       DRM_ERROR(
-                               "KMS: Cannot support more than %d display 
indexes\n",
-                                       AMDGPU_DM_MAX_DISPLAY_INDEX);
-                       continue;
-               }
-
                aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL);
                if (!aconnector)
                        goto fail;
-- 
2.34.1

Reply via email to