NumDfPstatesEnabled from SMU/PMFW is used to iterate over DfPstateTable[]
in dcn314_clk_mgr_helper_populate_bw_params(). The value is not validated
against the maximum number of DF P-states supported.
Although we have not observed any firmware returning an invalid value,
an oversized NumDfPstatesEnabled could cause an out-of-bounds read.
A similar bounds issue in dcn35_clkmgr was previously fixed and assigned
CVE-2024-26699. This patch applies the same defensive check to dcn314.
Clamp NumDfPstatesEnabled to NUM_DF_PSTATE_LEVELS before using it.
Fixes: 19f7b8334484 ("drm/amd/display: Update clock table policy for DCN314")
Signed-off-by: Kery Qi <[email protected]>
---
.../drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
index db687a13174d..50ea75d974fd 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
@@ -754,9 +754,15 @@ static void
dcn314_clk_mgr_helper_populate_bw_params(struct clk_mgr_internal *cl
struct clk_limit_table_entry def_max =
bw_params->clk_table.entries[bw_params->clk_table.num_entries - 1];
uint32_t max_pstate = 0, max_fclk = 0, min_pstate = 0, max_dispclk =
0, max_dppclk = 0;
int i;
+ /* Clamp NumDfPstatesEnabled to avoid out-of-bounds access */
+ uint8_t num_memps = clock_table->NumDfPstatesEnabled;
+
+ if (num_memps > NUM_DF_PSTATE_LEVELS) {
+ num_memps = NUM_DF_PSTATE_LEVELS;
+ }
/* Find highest valid fclk pstate */
- for (i = 0; i < clock_table->NumDfPstatesEnabled; i++) {
+ for (i = 0; i < num_memps; i++) {
if (is_valid_clock_value(clock_table->DfPstateTable[i].FClk) &&
clock_table->DfPstateTable[i].FClk > max_fclk) {
max_fclk = clock_table->DfPstateTable[i].FClk;
@@ -782,7 +788,7 @@ static void dcn314_clk_mgr_helper_populate_bw_params(struct
clk_mgr_internal *cl
uint32_t min_fclk = clock_table->DfPstateTable[0].FClk;
int j;
- for (j = 1; j < clock_table->NumDfPstatesEnabled; j++) {
+ for (j = 1; j < num_memps; j++) {
if
(is_valid_clock_value(clock_table->DfPstateTable[j].FClk) &&
clock_table->DfPstateTable[j].FClk < min_fclk &&
clock_table->DfPstateTable[j].Voltage <=
clock_table->SocVoltage[i]) {
--
2.34.1
