CVE-2026-46263: drm/amd/display: Fix out-of-bounds stream encoder index v3

CVE-2026-46263: drm/amd/display: Fix out-of-bounds stream encoder index v3

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix out-of-bounds stream encoder index v3

eng_id can be negative and that stream_enc_regs[]
can be indexed out of bounds.

eng_id is used directly as an index into stream_enc_regs[], which has
only 5 entries. When eng_id is 5 (ENGINE_ID_DIGF) or negative, this can
access memory past the end of the array.

Add a bounds check using ARRAY_SIZE() before using eng_id as an index.
The unsigned cast also rejects negative values.

This avoids out-of-bounds access.

Fixes the below smatch error:
dcn*_resource.c: stream_encoder_create() may index
stream_enc_regs[eng_id] out of bounds (size 5).

drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn351/dcn351_resource.c
    1246 static struct stream_encoder *dcn35_stream_encoder_create(
    1247         enum engine_id eng_id,
    1248         struct dc_context *ctx)
    1249 {

    ...

    1255
    1256         /* Mapping of VPG, AFMT, DME register blocks to DIO block instance */
    1257         if (eng_id <= ENGINE_ID_DIGF) {

ENGINE_ID_DIGF is 5.  should <= be <?

Unrelated but, ugh, why is Smatch saying that "eng_id" can be negative?
end_id is type signed long, but there are checks in the caller which prevent it from being negative.

    1258                 vpg_inst = eng_id;
    1259                 afmt_inst = eng_id;
    1260         } else
    1261                 return NULL;
    1262

    ...

    1281
    1282         dcn35_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios,
    1283                                         eng_id, vpg, afmt,
--> 1284                                         &stream_enc_regs[eng_id],
                                                  ^^^^^^^^^^^^^^^^^^^^^^^ This stream_enc_regs[] array has 5 elements so we are one element beyond the end of the array.

    ...

    1287         return &enc1->base;
    1288 }

v2: use explicit bounds check as suggested by Roman/Dan; avoid unsigned int cast

v3: The compiler already knows how to compare the two values, so the
    cast (int) is not needed. (Roman)

The Linux kernel CVE team has assigned CVE-2026-46263 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.9 with commit 2728e9c7c84235d2d7bc1403174d071ffc82d6d2 and fixed in 6.12.75 with commit 29f3824b08a98d41ecbbfd33580630d7607f962e
	Issue introduced in 6.9 with commit 2728e9c7c84235d2d7bc1403174d071ffc82d6d2 and fixed in 6.18.14 with commit 263e28add4f4472cfa95150d218955d1945aa413
	Issue introduced in 6.9 with commit 2728e9c7c84235d2d7bc1403174d071ffc82d6d2 and fixed in 6.19.4 with commit ca3808d560ad946ab6d089fd1f5bee04b952ead4
	Issue introduced in 6.9 with commit 2728e9c7c84235d2d7bc1403174d071ffc82d6d2 and fixed in 7.0 with commit abde491143e4e12eecc41337910aace4e8d59603

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-46263
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c
	drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c
	drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c
	drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c
	drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
	drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/29f3824b08a98d41ecbbfd33580630d7607f962e
	https://git.kernel.org/stable/c/263e28add4f4472cfa95150d218955d1945aa413
	https://git.kernel.org/stable/c/ca3808d560ad946ab6d089fd1f5bee04b952ead4
	https://git.kernel.org/stable/c/abde491143e4e12eecc41337910aace4e8d59603