]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
authorYang Wang <kevinyang.wang@amd.com>
Wed, 22 Oct 2025 06:12:21 +0000 (14:12 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 13 Nov 2025 20:33:59 +0000 (15:33 -0500)
[ Upstream commit 238d468d3ed18a324bb9d8c99f18c665dbac0511 ]

'table_index' is a variable defined by the smu driver (kmd)
'table_id' is a variable defined by the hw smu (pmfw)

This code should use table_index as a bounds check.

Fixes: caad2613dc4bd ("drm/amd/powerplay: move table setting common code to smu_cmn.c")
Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit fca0c66b22303de0d1d6313059baf4dc960a4753)
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c

index 0ce1766c859f5c06dcb0a7220faf383e0e5663be..d2f11d82312f0eb40600ceb74fee10dfd85e120d 100644 (file)
@@ -955,7 +955,7 @@ int smu_cmn_update_table(struct smu_context *smu,
                                                      table_index);
        uint32_t table_size;
        int ret = 0;
-       if (!table_data || table_id >= SMU_TABLE_COUNT || table_id < 0)
+       if (!table_data || table_index >= SMU_TABLE_COUNT || table_id < 0)
                return -EINVAL;
 
        table_size = smu_table->tables[table_index].size;