drm/amd/display: Limit clock assignments by size of clk tables

[WHAT & HOW]
Check clk table's array size to avoid out-of-bound memory accesses.

This fixes two OVERRUN issues reported by Coverity.

Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c
index 005092b0a0cbbc999e6e5b95284a800146b36d85..7db7446ad91f4873f7b6b53af1aec26eedec6f29 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn401/dcn401_clk_mgr.c
@@ -130,7 +130,7 @@ static void dcn401_init_single_clock(struct clk_mgr_internal *clk_mgr, PPCLK_e c
                *num_levels = ret & 0xFF;
 
        /* if the initial message failed, num_levels will be 0 */
-       for (i = 0; i < *num_levels; i++) {
+       for (i = 0; i < *num_levels && i < ARRAY_SIZE(clk_mgr->base.bw_params->clk_table.entries); i++) {
                *((unsigned int *)entry_i) = (dcn30_smu_get_dpm_freq_by_index(clk_mgr, clk, i) & 0xFFFF);
                entry_i += sizeof(clk_mgr->base.bw_params->clk_table.entries[0]);
        }