drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup

vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc,
vddci and vddmem lookup tables without bounds checks across nine sites.
Return -EINVAL when any index is out of range.

Fixes: f83a9991648b ("drm/amd/powerplay: add Vega10 powerplay support (v5)")
Signed-off-by: Asad Kamal <asad.kamal@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
index 629815f0c5d43dec3c9664cfd4c2fc48a127c3e9..0e237feb1629b9cc2b16afc2063652f4cf4fed2c 100644 (file)
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
@@ -685,10 +685,18 @@ static int vega10_patch_voltage_dependency_tables_with_lookup_table(
                        case 3: vdt = table_info->vdd_dep_on_pixclk; break;
                        case 4: vdt = table_info->vdd_dep_on_dispclk; break;
                        case 5: vdt = table_info->vdd_dep_on_phyclk; break;
+                       default:
+                               continue;
                }
 
                for (entry_id = 0; entry_id < vdt->count; entry_id++) {
                        voltage_id = vdt->entries[entry_id].vddInd;
+                       if (voltage_id >= table_info->vddc_lookup_table->count) {
+                               pr_err("amdgpu: clk_dep[%u][%u] vddc index %u out of bounds (%u)\n",
+                                      i, entry_id, voltage_id,
+                                      table_info->vddc_lookup_table->count);
+                               return -EINVAL;
+                       }
                        vdt->entries[entry_id].vddc =
                                        table_info->vddc_lookup_table->entries[voltage_id].us_vdd;
                }
@@ -696,23 +704,48 @@ static int vega10_patch_voltage_dependency_tables_with_lookup_table(
 
        for (entry_id = 0; entry_id < mm_table->count; ++entry_id) {
                voltage_id = mm_table->entries[entry_id].vddcInd;
+               if (voltage_id >= table_info->vddc_lookup_table->count) {
+                       pr_err("amdgpu: mm[%u] vddc index %u out of bounds (%u)\n",
+                              entry_id, voltage_id,
+                              table_info->vddc_lookup_table->count);
+                       return -EINVAL;
+               }
                mm_table->entries[entry_id].vddc =
                        table_info->vddc_lookup_table->entries[voltage_id].us_vdd;
        }
 
        for (entry_id = 0; entry_id < mclk_table->count; ++entry_id) {
                voltage_id = mclk_table->entries[entry_id].vddInd;
+               if (voltage_id >= table_info->vddc_lookup_table->count) {
+                       pr_err("amdgpu: mclk[%u] vddc index %u out of bounds (%u)\n",
+                              entry_id, voltage_id,
+                              table_info->vddc_lookup_table->count);
+                       return -EINVAL;
+               }
                mclk_table->entries[entry_id].vddc =
                                table_info->vddc_lookup_table->entries[voltage_id].us_vdd;
+
                voltage_id = mclk_table->entries[entry_id].vddciInd;
+               if (voltage_id >= table_info->vddci_lookup_table->count) {
+                       pr_err("amdgpu: mclk[%u] vddci index %u out of bounds (%u)\n",
+                              entry_id, voltage_id,
+                              table_info->vddci_lookup_table->count);
+                       return -EINVAL;
+               }
                mclk_table->entries[entry_id].vddci =
                                table_info->vddci_lookup_table->entries[voltage_id].us_vdd;
+
                voltage_id = mclk_table->entries[entry_id].mvddInd;
+               if (voltage_id >= table_info->vddmem_lookup_table->count) {
+                       pr_err("amdgpu: mclk[%u] vddmem index %u out of bounds (%u)\n",
+                              entry_id, voltage_id,
+                              table_info->vddmem_lookup_table->count);
+                       return -EINVAL;
+               }
                mclk_table->entries[entry_id].mvdd =
                                table_info->vddmem_lookup_table->entries[voltage_id].us_vdd;
        }
 
-
        return 0;
 
 }