]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm/amd/display: Fix bounds checking in dml2_0 clock table array
authorGabe Teeger <gabe.teeger@amd.com>
Mon, 16 Mar 2026 14:41:27 +0000 (10:41 -0400)
committerAlex Deucher <alexander.deucher@amd.com>
Mon, 30 Mar 2026 18:40:20 +0000 (14:40 -0400)
commit1f991ceb2c0bd37214387a645a1d3a260d423f7d
tree7779eb632fe31380c71cf459c62185390f74b0e0
parentee212b0208a18831d2b537865da56708c17af90d
drm/amd/display: Fix bounds checking in dml2_0 clock table array

[Why]
Multiple locations in dml2_0 used num_clk_values-1 as array index
without checking if num_clk_values > 0. When num_clk_values is 0,
this results in accessing array index -1, which wraps to 255 for
unsigned types, causing out-of-bounds memory access and potential
crashes.

[How]
Add proper bounds checking using ternary operators to guard all
num_clk_values-1 array accesses. When num_clk_values is 0, return 0
as fallback value instead of accessing invalid memory. This prevents
buffer overflows while maintaining backward compatibility and provides
sensible default behavior for empty clock tables.

Reviewed-by: Dillon Varone <dillon.varone@amd.com>
Signed-off-by: Gabe Teeger <gabe.teeger@amd.com>
Signed-off-by: Chuanyu Tseng <chuanyu.tseng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_dpmm/dml2_dpmm_dcn4.c
drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_mcg/dml2_mcg_dcn4.c
drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_mcg/dml2_mcg_dcn42.c