Commit c3d74960 authored by Hamza Mahfooz's avatar Hamza Mahfooz Committed by Alex Deucher
Browse files

drm/amd/display: fix possible buffer overflow relating to secure display 



It is possible that adev->dm.dc->caps.max_links is greater than
AMDGPU_MAX_CRTCS. So, to not potentially access unallocated memory use
adev->mode_info.num_crtc to do the bounds check instead of
adev->dm.dc->caps.max_links.

Fixes: 1b11ff76 ("drm/amd/display: Implement multiple secure display")
Fixes: b8ff7e08 ("drm/amd/display: Fix when disabling secure_display")
Reviewed-by: default avatarAlan Liu <HaoPing.Liu@amd.com>
Signed-off-by: default avatarHamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 0c2dece8

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c

+1 −1
Original line number Diff line number Diff line
@@ -1741,7 +1741,7 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev) 


#if defined(CONFIG_DRM_AMD_SECURE_DISPLAY)

	if (adev->dm.secure_display_ctxs) {

		for (i = 0; i < adev->dm.dc->caps.max_links; i++) {

		for (i = 0; i < adev->mode_info.num_crtc; i++) {

			if (adev->dm.secure_display_ctxs[i].crtc) {

				flush_work(&adev->dm.secure_display_ctxs[i].notify_ta_work);

				flush_work(&adev->dm.secure_display_ctxs[i].forward_roi_work);

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c

+5 −3
Original line number Diff line number Diff line
@@ -223,7 +223,7 @@ int amdgpu_dm_crtc_configure_crc_source(struct drm_crtc *crtc, 
#if defined(CONFIG_DRM_AMD_SECURE_DISPLAY)

		/* Disable secure_display if it was enabled */

		if (!enable) {

			for (i = 0; i < adev->dm.dc->caps.max_links; i++) {

			for (i = 0; i < adev->mode_info.num_crtc; i++) {

				if (adev->dm.secure_display_ctxs[i].crtc == crtc) {

					/* stop ROI update on this crtc */

					flush_work(&adev->dm.secure_display_ctxs[i].notify_ta_work);
@@ -544,12 +544,14 @@ amdgpu_dm_crtc_secure_display_create_contexts(struct amdgpu_device *adev) 
	struct secure_display_context *secure_display_ctxs = NULL;

	int i;



	secure_display_ctxs = kcalloc(AMDGPU_MAX_CRTCS, sizeof(struct secure_display_context), GFP_KERNEL);

	secure_display_ctxs = kcalloc(adev->mode_info.num_crtc,

				      sizeof(struct secure_display_context),

				      GFP_KERNEL);



	if (!secure_display_ctxs)

		return NULL;



	for (i = 0; i < adev->dm.dc->caps.max_links; i++) {

	for (i = 0; i < adev->mode_info.num_crtc; i++) {

		INIT_WORK(&secure_display_ctxs[i].forward_roi_work, amdgpu_dm_forward_crc_window);

		INIT_WORK(&secure_display_ctxs[i].notify_ta_work, amdgpu_dm_crtc_notify_ta_to_read);

		secure_display_ctxs[i].crtc = &adev->mode_info.crtcs[i]->base;