+++ /dev/null
-From fcf2e91100e8a324ce35013028fc94e429898425 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 13 Sep 2023 16:18:44 -0400
-Subject: drm/amd/display: Guard against invalid RPTR/WPTR being set
-
-From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
-
-[ Upstream commit 1ffa8602e39b89469dc703ebab7a7e44c33da0f7 ]
-
-[WHY]
-HW can return invalid values on register read, guard against these being
-set and causing us to access memory out of range and page fault.
-
-[HOW]
-Guard at sync_inbox1 and guard at pushing commands.
-
-Cc: Mario Limonciello <mario.limonciello@amd.com>
-Cc: Alex Deucher <alexander.deucher@amd.com>
-Cc: stable@vger.kernel.org
-Reviewed-by: Hansen Dsouza <hansen.dsouza@amd.com>
-Acked-by: Alex Hung <alex.hung@amd.com>
-Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
-Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- .../gpu/drm/amd/display/dmub/src/dmub_srv.c | 18 +++++++++++++++---
- 1 file changed, 15 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
-index 6b8bd556c872f..e951fd837aa27 100644
---- a/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
-+++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c
-@@ -675,9 +675,16 @@ enum dmub_status dmub_srv_sync_inbox1(struct dmub_srv *dmub)
- return DMUB_STATUS_INVALID;
-
- if (dmub->hw_funcs.get_inbox1_rptr && dmub->hw_funcs.get_inbox1_wptr) {
-- dmub->inbox1_rb.rptr = dmub->hw_funcs.get_inbox1_rptr(dmub);
-- dmub->inbox1_rb.wrpt = dmub->hw_funcs.get_inbox1_wptr(dmub);
-- dmub->inbox1_last_wptr = dmub->inbox1_rb.wrpt;
-+ uint32_t rptr = dmub->hw_funcs.get_inbox1_rptr(dmub);
-+ uint32_t wptr = dmub->hw_funcs.get_inbox1_wptr(dmub);
-+
-+ if (rptr > dmub->inbox1_rb.capacity || wptr > dmub->inbox1_rb.capacity) {
-+ return DMUB_STATUS_HW_FAILURE;
-+ } else {
-+ dmub->inbox1_rb.rptr = rptr;
-+ dmub->inbox1_rb.wrpt = wptr;
-+ dmub->inbox1_last_wptr = dmub->inbox1_rb.wrpt;
-+ }
- }
-
- return DMUB_STATUS_OK;
-@@ -711,6 +718,11 @@ enum dmub_status dmub_srv_cmd_queue(struct dmub_srv *dmub,
- if (!dmub->hw_init)
- return DMUB_STATUS_INVALID;
-
-+ if (dmub->inbox1_rb.rptr > dmub->inbox1_rb.capacity ||
-+ dmub->inbox1_rb.wrpt > dmub->inbox1_rb.capacity) {
-+ return DMUB_STATUS_HW_FAILURE;
-+ }
-+
- if (dmub_rb_push_front(&dmub->inbox1_rb, cmd))
- return DMUB_STATUS_OK;
-
---
-2.42.0
-