drm/amdgpu/gmc9.0: add bounds checking for cid

commit f39e1270277f4b06db0b2c6ec9405b6dd766fb13 upstream.

The value should never exceed the array size as those
are the only values the hardware is expected to return,
but add checks anyway.

Cc: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit e14d468304832bcc4a082d95849bc0a41b18ddea)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index 78c527b56f7c52a4fa10cbf1c2e64247e8bdc2f1..91c6464efed2adb6802c7ea769749775ee8b23e8 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -688,28 +688,35 @@ static int gmc_v9_0_process_interrupt(struct amdgpu_device *adev,
        } else {
                switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
                case IP_VERSION(9, 0, 0):
-                       mmhub_cid = mmhub_client_ids_vega10[cid][rw];
+                       mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega10) ?
+                               mmhub_client_ids_vega10[cid][rw] : NULL;
                        break;
                case IP_VERSION(9, 3, 0):
-                       mmhub_cid = mmhub_client_ids_vega12[cid][rw];
+                       mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega12) ?
+                               mmhub_client_ids_vega12[cid][rw] : NULL;
                        break;
                case IP_VERSION(9, 4, 0):
-                       mmhub_cid = mmhub_client_ids_vega20[cid][rw];
+                       mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega20) ?
+                               mmhub_client_ids_vega20[cid][rw] : NULL;
                        break;
                case IP_VERSION(9, 4, 1):
-                       mmhub_cid = mmhub_client_ids_arcturus[cid][rw];
+                       mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_arcturus) ?
+                               mmhub_client_ids_arcturus[cid][rw] : NULL;
                        break;
                case IP_VERSION(9, 1, 0):
                case IP_VERSION(9, 2, 0):
-                       mmhub_cid = mmhub_client_ids_raven[cid][rw];
+                       mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_raven) ?
+                               mmhub_client_ids_raven[cid][rw] : NULL;
                        break;
                case IP_VERSION(1, 5, 0):
                case IP_VERSION(2, 4, 0):
-                       mmhub_cid = mmhub_client_ids_renoir[cid][rw];
+                       mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_renoir) ?
+                               mmhub_client_ids_renoir[cid][rw] : NULL;
                        break;
                case IP_VERSION(1, 8, 0):
                case IP_VERSION(9, 4, 2):
-                       mmhub_cid = mmhub_client_ids_aldebaran[cid][rw];
+                       mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_aldebaran) ?
+                               mmhub_client_ids_aldebaran[cid][rw] : NULL;
                        break;
                default:
                        mmhub_cid = NULL;