diff options
| author | Jonathan Gray <jsg@cvs.openbsd.org> | 2023-12-11 05:20:30 +0000 |
|---|---|---|
| committer | Jonathan Gray <jsg@cvs.openbsd.org> | 2023-12-11 05:20:30 +0000 |
| commit | b6fc9f3959d370782641e35544760acb401012bf (patch) | |
| tree | 001ff1af19eb636d3b4708965a6f01f9bb489e9b /sys | |
| parent | 0f43e9d3c2f480225f8df3a8444ccb4b0d145f3d (diff) | |
drm/amd/display: Guard against invalid RPTR/WPTR being set
From Nicholas Kazlauskas
195514bda626b16fb6ef9ff4172dc0433a3c105b in linux-6.1.y/6.1.66
1ffa8602e39b89469dc703ebab7a7e44c33da0f7 in mainline linux
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/dev/pci/drm/amd/display/dmub/src/dmub_srv.c | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/sys/dev/pci/drm/amd/display/dmub/src/dmub_srv.c b/sys/dev/pci/drm/amd/display/dmub/src/dmub_srv.c index 6b8bd556c87..e951fd837aa 100644 --- a/sys/dev/pci/drm/amd/display/dmub/src/dmub_srv.c +++ b/sys/dev/pci/drm/amd/display/dmub/src/dmub_srv.c @@ -675,9 +675,16 @@ enum dmub_status dmub_srv_sync_inbox1(struct dmub_srv *dmub) return DMUB_STATUS_INVALID; if (dmub->hw_funcs.get_inbox1_rptr && dmub->hw_funcs.get_inbox1_wptr) { - dmub->inbox1_rb.rptr = dmub->hw_funcs.get_inbox1_rptr(dmub); - dmub->inbox1_rb.wrpt = dmub->hw_funcs.get_inbox1_wptr(dmub); - dmub->inbox1_last_wptr = dmub->inbox1_rb.wrpt; + uint32_t rptr = dmub->hw_funcs.get_inbox1_rptr(dmub); + uint32_t wptr = dmub->hw_funcs.get_inbox1_wptr(dmub); + + if (rptr > dmub->inbox1_rb.capacity || wptr > dmub->inbox1_rb.capacity) { + return DMUB_STATUS_HW_FAILURE; + } else { + dmub->inbox1_rb.rptr = rptr; + dmub->inbox1_rb.wrpt = wptr; + dmub->inbox1_last_wptr = dmub->inbox1_rb.wrpt; + } } return DMUB_STATUS_OK; @@ -711,6 +718,11 @@ enum dmub_status dmub_srv_cmd_queue(struct dmub_srv *dmub, if (!dmub->hw_init) return DMUB_STATUS_INVALID; + if (dmub->inbox1_rb.rptr > dmub->inbox1_rb.capacity || + dmub->inbox1_rb.wrpt > dmub->inbox1_rb.capacity) { + return DMUB_STATUS_HW_FAILURE; + } + if (dmub_rb_push_front(&dmub->inbox1_rb, cmd)) return DMUB_STATUS_OK; |