[PATCH] drm/amd/display: dcn315: validate NumDfPstatesEnabled in bw params

[PATCH] drm/amd/display: dcn315: validate NumDfPstatesEnabled in bw params

[Kery Qi]

dcn315_clk_mgr_helper_populate_bw_params() derives max_pstate from
clock_table->NumDfPstatesEnabled and uses it to index DfPstateTable[].
NumDfPstatesEnabled is provided by SMU/PMFW and is not validated.

If NumDfPstatesEnabled is 0, max_pstate underflows and later accesses
DfPstateTable[max_pstate]. If it is larger than NUM_DF_PSTATE_LEVELS,
the helper may read past the end of DfPstateTable[] when populating
the clock table, potentially crashing the kernel.

A similar missing bounds check was fixed in dcn35_clkmgr and assigned
CVE-2024-26699. We have not confirmed a concrete trigger for dcn315,
but this is a defensive hardening to avoid potential OOB reads.

Clamp NumDfPstatesEnabled to a sane range before using it for loop
bounds and max_pstate selection.

Fixes: 60f6fe665e85 ("drm/amd/display: update dcn315 clock table read")
Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
---
 .../drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
index 3a881451e9da..eba71cc9f6f8 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
@@ -548,15 +548,21 @@ static void dcn315_clk_mgr_helper_populate_bw_params(
 {
 	int i;
 	struct clk_bw_params *bw_params = clk_mgr->base.bw_params;
-	uint32_t max_pstate = clock_table->NumDfPstatesEnabled - 1;
 	struct clk_limit_table_entry def_max = bw_params->clk_table.entries[bw_params->clk_table.num_entries - 1];
+	/* Clamp NumDfPstatesEnabled to avoid out-of-bounds access */
+	uint8_t num_memps = clock_table->NumDfPstatesEnabled;
+	uint32_t max_pstate;
+
+	if (num_memps > NUM_DF_PSTATE_LEVELS)
+		num_memps = NUM_DF_PSTATE_LEVELS;
+	max_pstate = num_memps - 1;
 
 	/* For 315 we want to base clock table on dcfclk, need at least one entry regardless of pmfw table */
 	for (i = 0; i < clock_table->NumDcfClkLevelsEnabled; i++) {
 		int j;
 
 		/* DF table is sorted with clocks decreasing */
-		for (j = clock_table->NumDfPstatesEnabled - 2; j >= 0; j--) {
+		for (j = num_memps - 2; j >= 0; j--) {
 			if (clock_table->DfPstateTable[j].Voltage <= clock_table->SocVoltage[i])
 				max_pstate = j;
 		}
-- 
2.34.1