linux-kernel - [PATCH] drm/amd/display: fix array-bounds error in dc_stream_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <7bafafdf.f5.18456e11abd.Coremail.wangkailong@jari.cn>
Date:   Tue, 8 Nov 2022 18:55:03 +0800 (GMT+08:00)
From:   wangkailong@...i.cn
To:     Wentland <harry.wentland@....com>, Li <sunpeng.li@....com>,
        Siqueira <Rodrigo.Siqueira@....com>,
        Deucher <alexander.deucher@....com>,
        Christian König <christian.koenig@....com>,
        "Pan, Xinhui" <Xinhui.Pan@....com>, Airlie <airlied@...il.com>,
        Vetter <daniel@...ll.ch>
Cc:     amd-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
        linux-kernel@...r.kernel.org
Subject:  [PATCH] drm/amd/display: fix array-bounds error in
 dc_stream_remove_writeback()

replace the subsequent check for 'i != j' with 
Delete header file "timing_generator.h"

Signed-off-by: KaiLong Wang <wangkailong@...i.cn>
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 38d71b5c1f2d..66661a20117b 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -29,7 +29,6 @@
 #include "core_types.h"
 #include "resource.h"
 #include "ipp.h"
-#include "timing_generator.h"
 #include "dc_dmub_srv.h"
 
 #define DC_LOGGER dc->ctx->logger
@@ -152,9 +151,8 @@ static void dc_stream_free(struct kref *kref)
 
 void dc_stream_release(struct dc_stream_state *stream)
 {
-	if (stream != NULL) {
+	if (stream != NULL)
 		kref_put(&stream->refcount, dc_stream_free);
-	}
 }
 
 struct dc_stream_state *dc_create_stream_for_sink(
@@ -316,11 +314,11 @@ bool dc_stream_set_cursor_attributes(
 	struct dc  *dc;
 	bool reset_idle_optimizations = false;
 
-	if (NULL == stream) {
+	if (stream == NULL) {
 		dm_error("DC: dc_stream is NULL!\n");
 		return false;
 	}
-	if (NULL == attributes) {
+	if (attributes == NULL) {
 		dm_error("DC: attributes is NULL!\n");
 		return false;
 	}
@@ -399,12 +397,12 @@ bool dc_stream_set_cursor_position(
 	struct dc  *dc = stream->ctx->dc;
 	bool reset_idle_optimizations = false;
 
-	if (NULL == stream) {
+	if (stream == NULL) {
 		dm_error("DC: dc_stream is NULL!\n");
 		return false;
 	}
 
-	if (NULL == position) {
+	if (position == NULL) {
 		dm_error("DC: cursor position is NULL!\n");
 		return false;
 	}
@@ -468,9 +466,8 @@ bool dc_stream_add_writeback(struct dc *dc,
 		}
 	}
 
-	if (!isDrc) {
+	if (!isDrc)
 		stream->writeback_info[stream->num_wb_info++] = *wb_info;
-	}
 
 	if (dc->hwss.enable_writeback) {
 		struct dc_stream_status *stream_status = dc_stream_get_status(stream);
@@ -526,7 +523,7 @@ bool dc_stream_remove_writeback(struct dc *dc,
 	/* remove writeback info for disabled writeback pipes from stream */
 	for (i = 0, j = 0; i < stream->num_wb_info; i++) {
 		if (stream->writeback_info[i].wb_enabled) {
-			if (j < i)
+			if (i != j)
 				/* trim the array */
 				stream->writeback_info[j] = stream->writeback_info[i];
 			j++;
-- 
2.36.1