dcn315_clk_mgr_helper_populate_bw_params() derives max_pstate from
clock_table->NumDfPstatesEnabled and uses it to index DfPstateTable[].
NumDfPstatesEnabled is provided by SMU/PMFW and is not validated.
If NumDfPstatesEnabled is 0, max_pstate underflows and later accesses
DfPstateTable[max_pstate]. If it is larger than NUM_DF_PSTATE_LEVELS,
the helper may read past the end of DfPstateTable[] when populating
the clock table, potentially crashing the kernel.
A similar missing bounds check was fixed in dcn35_clkmgr and assigned
CVE-2024-26699. We have not confirmed a concrete trigger for dcn315,
but this is a defensive hardening to avoid potential OOB reads.
Clamp NumDfPstatesEnabled to a sane range before using it for loop
bounds and max_pstate selection.
Fixes: 60f6fe665e85 ("drm/amd/display: update dcn315 clock table read")
Signed-off-by: Kery Qi <[email protected]>
---
.../drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
index 3a881451e9da..eba71cc9f6f8 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
@@ -548,15 +548,21 @@ static void dcn315_clk_mgr_helper_populate_bw_params(
{
int i;
struct clk_bw_params *bw_params = clk_mgr->base.bw_params;
- uint32_t max_pstate = clock_table->NumDfPstatesEnabled - 1;
struct clk_limit_table_entry def_max =
bw_params->clk_table.entries[bw_params->clk_table.num_entries - 1];
+ /* Clamp NumDfPstatesEnabled to avoid out-of-bounds access */
+ uint8_t num_memps = clock_table->NumDfPstatesEnabled;
+ uint32_t max_pstate;
+
+ if (num_memps > NUM_DF_PSTATE_LEVELS)
+ num_memps = NUM_DF_PSTATE_LEVELS;
+ max_pstate = num_memps - 1;
/* For 315 we want to base clock table on dcfclk, need at least one
entry regardless of pmfw table */
for (i = 0; i < clock_table->NumDcfClkLevelsEnabled; i++) {
int j;
/* DF table is sorted with clocks decreasing */
- for (j = clock_table->NumDfPstatesEnabled - 2; j >= 0; j--) {
+ for (j = num_memps - 2; j >= 0; j--) {
if (clock_table->DfPstateTable[j].Voltage <=
clock_table->SocVoltage[i])
max_pstate = j;
}
--
2.34.1
