- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] drm/amd/display: Assign linear_pitch_alignment even for VM
by Gu Bowen 30 Sep '24

30 Sep '24

From: Alvin Lee <alvin.lee2(a)amd.com> stable inclusion from stable-v6.1.109 commit d219f902b16d42f0cb8c499ea8f31cf3c0f36349 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARVIX CVE: CVE-2024-46732 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 984debc133efa05e62f5aa1a7a1dd8ca0ef041f4 ] [Description] Assign linear_pitch_alignment so we don't cause a divide by 0 error in VM environments Reviewed-by: Sohaib Nadeem <sohaib.nadeem(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Alvin Lee <alvin.lee2(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/display/dc/core/dc.c [Context conflicts with dc_create().] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index 050e46741c99..adcf5ba83703 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -938,6 +938,7 @@ struct dc *dc_create(const struct dc_init_data *init_params) goto alloc_fail; if (init_params->dce_environment == DCE_ENV_VIRTUAL_HW) { + dc->caps.linear_pitch_alignment = 64; if (false == dc_construct_ctx(dc, init_params)) { dc_destruct(dc); goto construct_fail; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 V1] nvmet-tcp: fix kernel crash if commands allocation fails
by Cheng Yu 30 Sep '24

30 Sep '24

From: Maurizio Lombardi <mlombard(a)redhat.com> stable inclusion from stable-v5.10.226 commit 50632b877ce55356f5d276b9add289b1e7ddc683 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYBC CVE: CVE-2024-46737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5572a55a6f830ee3f3a994b6b962a5c327d28cb3 ] If the commands allocation fails in nvmet_tcp_alloc_cmds() the kernel crashes in nvmet_tcp_release_queue_work() because of a NULL pointer dereference. nvmet: failed to install queue 0 cntlid 1 ret 6 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Fix the bug by setting queue->nr_cmds to zero in case nvmet_tcp_alloc_cmd() fails. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Signed-off-by: Maurizio Lombardi <mlombard(a)redhat.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/nvme/target/tcp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index dc52372ed7b8..d90f7f249da6 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -1787,8 +1787,10 @@ static u16 nvmet_tcp_install_queue(struct nvmet_sq *sq) } queue->nr_cmds = sq->size * 2; - if (nvmet_tcp_alloc_cmds(queue)) + if (nvmet_tcp_alloc_cmds(queue)) { + queue->nr_cmds = 0; return NVME_SC_INTERNAL; + } return 0; } -- 2.25.1

2 1

[PATCH OLK-6.6 V1] nvmet-tcp: fix kernel crash if commands allocation fails
by Cheng Yu 30 Sep '24

30 Sep '24

From: Maurizio Lombardi <mlombard(a)redhat.com> stable inclusion from stable-v6.6.51 commit 489f2913a63f528cfe3f21722583fb981967ecda category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYBC CVE: CVE-2024-46737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5572a55a6f830ee3f3a994b6b962a5c327d28cb3 ] If the commands allocation fails in nvmet_tcp_alloc_cmds() the kernel crashes in nvmet_tcp_release_queue_work() because of a NULL pointer dereference. nvmet: failed to install queue 0 cntlid 1 ret 6 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Fix the bug by setting queue->nr_cmds to zero in case nvmet_tcp_alloc_cmd() fails. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Signed-off-by: Maurizio Lombardi <mlombard(a)redhat.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/nvme/target/tcp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 3d302815c6f3..f1f6c5fec7b0 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -1858,8 +1858,10 @@ static u16 nvmet_tcp_install_queue(struct nvmet_sq *sq) } queue->nr_cmds = sq->size * 2; - if (nvmet_tcp_alloc_cmds(queue)) + if (nvmet_tcp_alloc_cmds(queue)) { + queue->nr_cmds = 0; return NVME_SC_INTERNAL; + } return 0; } -- 2.25.1

2 1

[PATCH OLK-5.10 V1] nvmet-tcp: fix kernel crash if commands allocation fails
by Cheng Yu 30 Sep '24

30 Sep '24

From: Maurizio Lombardi <mlombard(a)redhat.com> stable inclusion from stable-v5.10.226 commit 50632b877ce55356f5d276b9add289b1e7ddc683 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYBC CVE: CVE-2024-46737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5572a55a6f830ee3f3a994b6b962a5c327d28cb3 ] If the commands allocation fails in nvmet_tcp_alloc_cmds() the kernel crashes in nvmet_tcp_release_queue_work() because of a NULL pointer dereference. nvmet: failed to install queue 0 cntlid 1 ret 6 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Fix the bug by setting queue->nr_cmds to zero in case nvmet_tcp_alloc_cmd() fails. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Signed-off-by: Maurizio Lombardi <mlombard(a)redhat.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/nvme/target/tcp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index d70a2fa4ba45..a9b0789d803b 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -1786,8 +1786,10 @@ static u16 nvmet_tcp_install_queue(struct nvmet_sq *sq) } queue->nr_cmds = sq->size * 2; - if (nvmet_tcp_alloc_cmds(queue)) + if (nvmet_tcp_alloc_cmds(queue)) { + queue->nr_cmds = 0; return NVME_SC_INTERNAL; + } return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Add array index check for hdcp ddc access
by Bowen You 30 Sep '24

30 Sep '24

From: Hersen Wu <hersenxs.wu(a)amd.com> stable inclusion from stable-5.10.226 commit 2a63c90c7a90ab2bd23deebc2814fc5b52abf6d2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9O7 CVE: CVE-2024-46804 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4e70c0f5251c25885c31ee84a31f99a01f7cf50e ] [Why] Coverity reports OVERRUN warning. Do not check if array index valid. [How] Check msg_id valid and valid array index. Reviewed-by: Alex Hung <alex.hung(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Hersen Wu <hersenxs.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- .../drm/amd/display/modules/hdcp/hdcp_ddc.c | 28 ++++++++++++++++--- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c index 8e9caae7c955..1b2df97226a3 100644 --- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c +++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c @@ -156,11 +156,16 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp, uint32_t cur_size = 0; uint32_t data_offset = 0; - if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) { + if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID || + msg_id >= MOD_HDCP_MESSAGE_ID_MAX) return MOD_HDCP_STATUS_DDC_FAILURE; - } if (is_dp_hdcp(hdcp)) { + int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) / + sizeof(hdcp_dpcd_addrs[0]); + if (msg_id >= num_dpcd_addrs) + return MOD_HDCP_STATUS_DDC_FAILURE; + while (buf_len > 0) { cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE); success = hdcp->config.ddc.funcs.read_dpcd(hdcp->config.ddc.handle, @@ -175,6 +180,11 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp, data_offset += cur_size; } } else { + int num_i2c_offsets = sizeof(hdcp_i2c_offsets) / + sizeof(hdcp_i2c_offsets[0]); + if (msg_id >= num_i2c_offsets) + return MOD_HDCP_STATUS_DDC_FAILURE; + success = hdcp->config.ddc.funcs.read_i2c( hdcp->config.ddc.handle, HDCP_I2C_ADDR, @@ -219,11 +229,16 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp, uint32_t cur_size = 0; uint32_t data_offset = 0; - if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) { + if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID || + msg_id >= MOD_HDCP_MESSAGE_ID_MAX) return MOD_HDCP_STATUS_DDC_FAILURE; - } if (is_dp_hdcp(hdcp)) { + int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) / + sizeof(hdcp_dpcd_addrs[0]); + if (msg_id >= num_dpcd_addrs) + return MOD_HDCP_STATUS_DDC_FAILURE; + while (buf_len > 0) { cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE); success = hdcp->config.ddc.funcs.write_dpcd( @@ -239,6 +254,11 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp, data_offset += cur_size; } } else { + int num_i2c_offsets = sizeof(hdcp_i2c_offsets) / + sizeof(hdcp_i2c_offsets[0]); + if (msg_id >= num_i2c_offsets) + return MOD_HDCP_STATUS_DDC_FAILURE; + hdcp->buf[0] = hdcp_i2c_offsets[msg_id]; memmove(&hdcp->buf[1], buf, buf_len); success = hdcp->config.ddc.funcs.write_i2c( -- 2.34.1

2 5

[PATCH OLK-6.6] drm/amd/display: Assign linear_pitch_alignment even for VM
by Gu Bowen 30 Sep '24

30 Sep '24

From: Alvin Lee <alvin.lee2(a)amd.com> stable inclusion from stable-v6.6.50 commit d2fe7ac613a1ea8c346c9f5c89dc6ecc27232997 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARVIX CVE: CVE-2024-46732 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 984debc133efa05e62f5aa1a7a1dd8ca0ef041f4 ] [Description] Assign linear_pitch_alignment so we don't cause a divide by 0 error in VM environments Reviewed-by: Sohaib Nadeem <sohaib.nadeem(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Alvin Lee <alvin.lee2(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index 72db370e2f21..50e643bfdfba 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1298,6 +1298,7 @@ struct dc *dc_create(const struct dc_init_data *init_params) return NULL; if (init_params->dce_environment == DCE_ENV_VIRTUAL_HW) { + dc->caps.linear_pitch_alignment = 64; if (!dc_construct_ctx(dc, init_params)) goto destruct_dc; } else { -- 2.25.1

2 1

[openeuler:OLK-6.6 7044/14254] drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:1236:6: warning: no previous prototype for 'rnpgbevf_alloc_rx_buffers'
by kernel test robot 30 Sep '24

30 Sep '24

Hi Dong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e4fe1cc5cc1a347dec844c60d34f6141780f05af commit: bf177ad1d8f72824180b44563c09f37562f645de [7044/14254] drivers: initial support for rnpgbevf drivers from Mucse Technology config: loongarch-randconfig-001-20240930 (https://download.01.org/0day-ci/archive/20240930/202409301357.XJDOWyKd-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240930/202409301357.XJDOWyKd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409301357.XJDOWyKd-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/mucse/rnpgbevf/vf.h:13, from drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf.h:14, from drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:27: drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_defines.h: In function '_rnp_skb_dump': drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_defines.h:265:23: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 265 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_defines.h:265:13: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 265 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_defines.h:264:23: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 264 | bool has_mac, has_trans; | ^~~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_defines.h:264:14: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 264 | bool has_mac, has_trans; | ^~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: At top level: drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:119:6: warning: no previous prototype for 'rnpgbevf_unmap_and_free_tx_resource' [-Wmissing-prototypes] 119 | void rnpgbevf_unmap_and_free_tx_resource(struct rnpgbevf_ring *ring, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:1236:6: warning: no previous prototype for 'rnpgbevf_alloc_rx_buffers' [-Wmissing-prototypes] 1236 | void rnpgbevf_alloc_rx_buffers(struct rnpgbevf_ring *rx_ring, u16 cleaned_count) | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: In function 'rnpgbevf_clean_rx_irq': drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:1530:14: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 1530 | bool xdp_xmit = false; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: At top level: drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:2263:6: warning: no previous prototype for 'rnpgbevf_write_eitr_rx' [-Wmissing-prototypes] 2263 | void rnpgbevf_write_eitr_rx(struct rnpgbevf_q_vector *q_vector) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:2361:6: warning: no previous prototype for 'rnpgbevf_configure_tx_ring' [-Wmissing-prototypes] 2361 | void rnpgbevf_configure_tx_ring(struct rnpgbevf_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:2426:6: warning: no previous prototype for 'rnpgbevf_disable_rx_queue' [-Wmissing-prototypes] 2426 | void rnpgbevf_disable_rx_queue(struct rnpgbevf_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:2432:6: warning: no previous prototype for 'rnpgbevf_enable_rx_queue' [-Wmissing-prototypes] 2432 | void rnpgbevf_enable_rx_queue(struct rnpgbevf_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:2438:6: warning: no previous prototype for 'rnpgbevf_configure_rx_ring' [-Wmissing-prototypes] 2438 | void rnpgbevf_configure_rx_ring(struct rnpgbevf_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: In function 'rnpgbevf_vlan_rx_kill_vid': drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:2561:13: warning: variable 'err' set but not used [-Wunused-but-set-variable] 2561 | int err = -EOPNOTSUPP; | ^~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: In function 'rnpgbevf_acquire_msix_vectors': drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:3187:13: warning: variable 'vector_threshold' set but not used [-Wunused-but-set-variable] 3187 | int vector_threshold; | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: At top level: drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:4378:6: warning: no previous prototype for 'rnpgbevf_tx_ctxtdesc' [-Wmissing-prototypes] 4378 | void rnpgbevf_tx_ctxtdesc(struct rnpgbevf_ring *tx_ring, u16 mss_seg_len, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:4820:6: warning: no previous prototype for 'rnpgbevf_maybe_tx_ctxtdesc' [-Wmissing-prototypes] 4820 | void rnpgbevf_maybe_tx_ctxtdesc(struct rnpgbevf_ring *tx_ring, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:4838:13: warning: no previous prototype for 'rnpgbevf_xmit_frame_ring' [-Wmissing-prototypes] 4838 | netdev_tx_t rnpgbevf_xmit_frame_ring(struct sk_buff *skb, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:5311:6: warning: no previous prototype for 'rnpgbevf_assign_netdev_ops' [-Wmissing-prototypes] 5311 | void rnpgbevf_assign_netdev_ops(struct net_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: In function 'rnpgbevf_request_msix_irqs': drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:1978:44: warning: '%d' directive output may be truncated writing between 1 and 5 bytes into a region of size between 1 and 16 [-Wformat-truncation=] 1978 | "%s-%s-%d-%d", netdev->name, "TxRx", i, | ^~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:1978:34: note: directive argument in the range [0, 65535] 1978 | "%s-%s-%d-%d", netdev->name, "TxRx", i, | ^~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:1977:25: note: 'snprintf' output between 10 and 29 bytes into a destination of size 24 1977 | snprintf(q_vector->name, sizeof(q_vector->name) - 1, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1978 | "%s-%s-%d-%d", netdev->name, "TxRx", i, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1979 | q_vector->v_idx); | ~~~~~~~~~~~~~~~~ vim +/rnpgbevf_alloc_rx_buffers +1236 drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c 1229 1230 #else 1231 /** 1232 * rnpgbevf_alloc_rx_buffers - Replace used receive buffers 1233 * @rx_ring: ring to place buffers on 1234 * @cleaned_count: number of buffers to replace 1235 **/ > 1236 void rnpgbevf_alloc_rx_buffers(struct rnpgbevf_ring *rx_ring, u16 cleaned_count) 1237 { 1238 union rnp_rx_desc *rx_desc; 1239 struct rnpgbevf_rx_buffer *bi; 1240 u16 i = rx_ring->next_to_use; 1241 u64 fun_id = ((u64)(rx_ring->vfnum) << (32 + 24)); 1242 u16 bufsz; 1243 /* nothing to do */ 1244 if (!cleaned_count) 1245 return; 1246 1247 rx_desc = RNPVF_RX_DESC(rx_ring, i); 1248 1249 BUG_ON(!rx_desc); 1250 1251 bi = &rx_ring->rx_buffer_info[i]; 1252 1253 BUG_ON(!bi); 1254 1255 i -= rx_ring->count; 1256 bufsz = rnpgbevf_rx_bufsz(rx_ring); 1257 1258 do { 1259 if (!rnpgbevf_alloc_mapped_page(rx_ring, bi)) 1260 break; 1261 1262 dma_sync_single_range_for_device(rx_ring->dev, bi->dma, 1263 bi->page_offset, bufsz, 1264 DMA_FROM_DEVICE); 1265 1266 /* Refresh the desc even if buffer_addrs didn't change 1267 * because each write-back erases this info. 1268 */ 1269 rx_desc->pkt_addr = 1270 cpu_to_le64(bi->dma + bi->page_offset + fun_id); 1271 1272 /* clean dd */ 1273 rx_desc->cmd = 0; 1274 1275 rx_desc++; 1276 bi++; 1277 i++; 1278 if (unlikely(!i)) { 1279 rx_desc = RNPVF_RX_DESC(rx_ring, 0); 1280 bi = rx_ring->rx_buffer_info; 1281 i -= rx_ring->count; 1282 } 1283 1284 /* clear the hdr_addr for the next_to_use descriptor */ 1285 cleaned_count--; 1286 } while (cleaned_count); 1287 1288 i += rx_ring->count; 1289 1290 if (rx_ring->next_to_use != i) 1291 rnpgbevf_update_rx_tail(rx_ring, i); 1292 } 1293 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 6865/14250] drivers/net/ethernet/mucse/rnpvf/rnpvf_regs.h:21:26: error: called object is not a function or function pointer
by kernel test robot 30 Sep '24

30 Sep '24

Hi Dong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 02590a1a9ea3aa1e89ddb076e71968ef7278fa8b commit: 6adab536d69347a10c2366aaf6b86de963d5994b [6865/14250] drivers: initial support for rnpvf drivers from Mucse Technology config: loongarch-randconfig-001-20240930 (https://download.01.org/0day-ci/archive/20240930/202409301139.po9zoLOB-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240930/202409301139.po9zoLOB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409301139.po9zoLOB-lkp@intel.com/ All error/warnings (new ones prefixed by >>): drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:127:6: warning: no previous prototype for 'rnpvf_unmap_and_free_tx_resource' [-Wmissing-prototypes] 127 | void rnpvf_unmap_and_free_tx_resource(struct rnpvf_ring *ring, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:1365:6: warning: no previous prototype for 'rnpvf_alloc_rx_buffers' [-Wmissing-prototypes] 1365 | void rnpvf_alloc_rx_buffers(struct rnpvf_ring *rx_ring, u16 cleaned_count) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: In function 'rnpvf_clean_rx_irq': drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:1659:14: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 1659 | bool xdp_xmit = false; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: At top level: drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:1945:6: warning: no previous prototype for 'update_rx_count' [-Wmissing-prototypes] 1945 | void update_rx_count(int cleaned, struct rnpvf_q_vector *q_vector) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:2420:6: warning: no previous prototype for 'rnpvf_write_eitr_rx' [-Wmissing-prototypes] 2420 | void rnpvf_write_eitr_rx(struct rnpvf_q_vector *q_vector) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:2523:6: warning: no previous prototype for 'rnpvf_configure_tx_ring' [-Wmissing-prototypes] 2523 | void rnpvf_configure_tx_ring(struct rnpvf_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:2589:6: warning: no previous prototype for 'rnpvf_disable_rx_queue' [-Wmissing-prototypes] 2589 | void rnpvf_disable_rx_queue(struct rnpvf_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:2595:6: warning: no previous prototype for 'rnpvf_enable_rx_queue' [-Wmissing-prototypes] 2595 | void rnpvf_enable_rx_queue(struct rnpvf_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:2601:6: warning: no previous prototype for 'rnpvf_configure_rx_ring' [-Wmissing-prototypes] 2601 | void rnpvf_configure_rx_ring(struct rnpvf_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: In function 'rnpvf_vlan_rx_kill_vid': drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:2736:13: warning: variable 'err' set but not used [-Wunused-but-set-variable] 2736 | int err = -EOPNOTSUPP; | ^~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: In function 'rnpvf_acquire_msix_vectors': drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:3307:13: warning: variable 'vector_threshold' set but not used [-Wunused-but-set-variable] 3307 | int vector_threshold; | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: In function 'irq_miss_check': drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:3456:26: warning: variable 'hw' set but not used [-Wunused-but-set-variable] 3456 | struct rnpvf_hw *hw; | ^~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: At top level: drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:4590:6: warning: no previous prototype for 'rnpvf_tx_ctxtdesc' [-Wmissing-prototypes] 4590 | void rnpvf_tx_ctxtdesc(struct rnpvf_ring *tx_ring, u16 mss_seg_len, | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:5039:6: warning: no previous prototype for 'rnpvf_maybe_tx_ctxtdesc' [-Wmissing-prototypes] 5039 | void rnpvf_maybe_tx_ctxtdesc(struct rnpvf_ring *tx_ring, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:5089:13: warning: no previous prototype for 'rnpvf_xmit_frame_ring' [-Wmissing-prototypes] 5089 | netdev_tx_t rnpvf_xmit_frame_ring(struct sk_buff *skb, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:5580:6: warning: no previous prototype for 'rnpvf_assign_netdev_ops' [-Wmissing-prototypes] 5580 | void rnpvf_assign_netdev_ops(struct net_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/mucse/rnpvf/vf.h:14, from drivers/net/ethernet/mucse/rnpvf/rnpvf.h:14, from drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:26: drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: In function 'rnpvf_vfnum': >> drivers/net/ethernet/mucse/rnpvf/rnpvf_regs.h:21:26: error: called object is not a function or function pointer 21 | #define RNP_DMA_RX_START (0x10) | ^ drivers/net/ethernet/mucse/rnpvf/rnpvf_regs.h:104:42: note: in definition of macro 'rnpvf_rd_reg' 104 | #define rnpvf_rd_reg(reg) readl((void *)(reg)) | ^~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:5599:21: note: in expansion of macro 'rd32' 5599 | v = rd32(hw, RNP_DMA_RX_START(ring)); | ^~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:5599:30: note: in expansion of macro 'RNP_DMA_RX_START' 5599 | v = rd32(hw, RNP_DMA_RX_START(ring)); | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:5591:13: warning: unused variable 'pfvfnum_reg' [-Wunused-variable] 5591 | u32 pfvfnum_reg; | ^~~~~~~~~~~ vim +21 drivers/net/ethernet/mucse/rnpvf/rnpvf_regs.h 13 14 #define RNP_DMA_RING_BASE 0x8000 15 #define RNP_DMA_RX_DESC_TIMEOUT_TH 0x8000 16 #define RNP_DMA_TX_DESC_FETCH_CTL 0x8004 17 #define RNP_DMA_TX_FLOW_CTRL_TM 0x8008 18 #define RNP_RING_BASE_N10 (0x8000) 19 #define RNP_RING_BASE_N500 (0x1000) 20 #define RNP_RING_OFFSET(i) (0x100 * (i)) > 21 #define RNP_DMA_RX_START (0x10) 22 #define RNP_DMA_RX_READY (0x14) 23 #define RNP_DMA_TX_START (0x18) 24 #define RNP_DMA_TX_READY (0x1c) 25 #define RNP_DMA_INT_STAT (0x20) 26 #define RNP_DMA_INT_MASK (0x24) 27 #define TX_INT_MASK (0x1 << 1) 28 #define RX_INT_MASK (0x1 << 0) 29 #define RNP_DMA_INT_CLR (0x28) 30 #define RNP_DMA_INT_TRIG (0x2c) 31 #define RNP_DMA_REG_RX_DESC_BUF_BASE_ADDR_HI (0x30) 32 #define RNP_DMA_REG_RX_DESC_BUF_BASE_ADDR_LO (0x34) 33 #define RNP_DMA_REG_RX_DESC_BUF_LEN (0x38) 34 #define RNP_DMA_REG_RX_DESC_BUF_HEAD (0x3c) 35 #define RNP_DMA_REG_RX_DESC_BUF_TAIL (0x40) 36 #define RNP_DMA_REG_RX_DESC_FETCH_CTRL (0x44) 37 #define RNP_DMA_REG_RX_INT_DELAY_TIMER (0x48) 38 #define RNP_DMA_REG_RX_INT_DELAY_PKTCNT (0x4c) 39 #define RNP_DMA_REG_RX_ARB_DEF_LVL (0x50) 40 #define PCI_DMA_REG_RX_DESC_TIMEOUT_TH (0x54) 41 #define PCI_DMA_REG_RX_SCATTER_LENGTH (0x58) 42 #define RNP_DMA_REG_TX_DESC_BUF_BASE_ADDR_HI (0x60) 43 #define RNP_DMA_REG_TX_DESC_BUF_BASE_ADDR_LO (0x64) 44 #define RNP_DMA_REG_TX_DESC_BUF_LEN (0x68) 45 #define RNP_DMA_REG_TX_DESC_BUF_HEAD (0x6c) 46 #define RNP_DMA_REG_TX_DESC_BUF_TAIL (0x70) 47 #define RNP_DMA_REG_TX_DESC_FETCH_CTRL (0x74) 48 #define RNP_DMA_REG_TX_INT_DELAY_TIMER (0x78) 49 #define RNP_DMA_REG_TX_INT_DELAY_PKTCNT (0x7c) 50 #define RNP_DMA_REG_TX_ARB_DEF_LVL (0x80) 51 #define RNP_DMA_REG_TX_FLOW_CTRL_TH (0x84) 52 #define RNP_DMA_REG_TX_FLOW_CTRL_TM (0x88) 53 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info
by Zheng Qixing 30 Sep '24

30 Sep '24

From: Justin Tee <justin.tee(a)broadcom.com> mainline inclusion from mainline-v6.11-rc1 commit ede596b1434b57c0b3fd5c02b326efe5c54f6e48 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9N8 CVE: CVE-2024-46842 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the routine unconditionally frees submitted mailbox commands regardless of return status. The issue is that for MBX_TIMEOUT cases, when firmware returns SFP information at a later time, that same mailbox memory region references previously freed memory in its cmpl routine. Fix by adding checks for the MBX_TIMEOUT return code. During mailbox resource cleanup, check the mbox flag to make sure that the wait did not timeout. If the MBOX_WAKE flag is not set, then do not free the resources because it will be freed when firmware completes the mailbox at a later time in its cmpl routine. Also, increase the timeout from 30 to 60 seconds to accommodate boot scripts requiring longer timeouts. Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Link: https://lore.kernel.org/r/20240628172011.25921-6-justintee8345@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/lpfc/lpfc_els.c [The conflict here is due to inconsistencies in the context caused by 18f7fe44bc79 ("scsi: lpfc: Define lpfc_nodelist type for ctx_ndlp ptr").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/lpfc/lpfc_els.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c index 44d3ada9fbbc..76fc32284a80 100644 --- a/drivers/scsi/lpfc/lpfc_els.c +++ b/drivers/scsi/lpfc/lpfc_els.c @@ -7304,13 +7304,13 @@ int lpfc_get_sfp_info_wait(struct lpfc_hba *phba, } mbox->vport = phba->pport; mbox->ctx_ndlp = (struct lpfc_rdp_context *)rdp_context; - - rc = lpfc_sli_issue_mbox_wait(phba, mbox, 30); + rc = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_SLI4_CONFIG_TMO); if (rc == MBX_NOT_FINISHED) { rc = 1; goto error; } - + if (rc == MBX_TIMEOUT) + goto error; if (phba->sli_rev == LPFC_SLI_REV4) mp = (struct lpfc_dmabuf *)(mbox->ctx_buf); else @@ -7364,7 +7364,10 @@ int lpfc_get_sfp_info_wait(struct lpfc_hba *phba, } mbox->ctx_ndlp = (struct lpfc_rdp_context *)rdp_context; - rc = lpfc_sli_issue_mbox_wait(phba, mbox, 30); + rc = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_SLI4_CONFIG_TMO); + + if (rc == MBX_TIMEOUT) + goto error; if (bf_get(lpfc_mqe_status, &mbox->u.mqe)) { rc = 1; goto error; @@ -7375,8 +7378,10 @@ int lpfc_get_sfp_info_wait(struct lpfc_hba *phba, DMP_SFF_PAGE_A2_SIZE); error: - mbox->ctx_buf = mpsave; - lpfc_mbox_rsrc_cleanup(phba, mbox, MBOX_THD_UNLOCKED); + if (mbox->mbox_flag & LPFC_MBX_WAKE) { + mbox->ctx_buf = mpsave; + lpfc_mbox_rsrc_cleanup(phba, mbox, MBOX_THD_UNLOCKED); + } return rc; -- 2.39.2

2 1

[PATCH OLK-6.6] drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box
by Huang Xiaojia 30 Sep '24

30 Sep '24

From: Hersen Wu <hersenxs.wu(a)amd.com> stable inclusion from stable-v6.6.50 commit 4003bac784380fed1f94f197350567eaa73a409d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LY CVE: CVE-2024-46811 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 188fd1616ec43033cedbe343b6579e9921e2d898 ] [Why] Coverity reports OVERRUN warning. soc.num_states could be 40. But array range of bw_params->clk_table.entries is 8. [How] Assert if soc.num_states greater than 8. Reviewed-by: Alex Hung <alex.hung(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Hersen Wu <hersenxs.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c | 10 ++++++++++ drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c | 10 ++++++++++ drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 10 ++++++++++ drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 10 ++++++++++ 4 files changed, 40 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c index e2bcd205aa93..8da97a96b1ce 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c @@ -304,6 +304,16 @@ void dcn302_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16; } + /* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. + * MAX_NUM_DPM_LVL is 8. + * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. + * DC__VOLTAGE_STATES is 40. + */ + if (num_states > MAX_NUM_DPM_LVL) { + ASSERT(0); + return; + } + dcn3_02_soc.num_states = num_states; for (i = 0; i < dcn3_02_soc.num_states; i++) { dcn3_02_soc.clock_limits[i].state = i; diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c index 3eb3a021ab7d..c283780ad062 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c @@ -299,6 +299,16 @@ void dcn303_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16; } + /* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. + * MAX_NUM_DPM_LVL is 8. + * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. + * DC__VOLTAGE_STATES is 40. + */ + if (num_states > MAX_NUM_DPM_LVL) { + ASSERT(0); + return; + } + dcn3_03_soc.num_states = num_states; for (i = 0; i < dcn3_03_soc.num_states; i++) { dcn3_03_soc.clock_limits[i].state = i; diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c index cf3b400c8619..3d82cbef1274 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c @@ -2885,6 +2885,16 @@ void dcn32_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_pa dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16; } + /* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. + * MAX_NUM_DPM_LVL is 8. + * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. + * DC__VOLTAGE_STATES is 40. + */ + if (num_states > MAX_NUM_DPM_LVL) { + ASSERT(0); + return; + } + dcn3_2_soc.num_states = num_states; for (i = 0; i < dcn3_2_soc.num_states; i++) { dcn3_2_soc.clock_limits[i].state = i; diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c index b26fcf86014c..ae2196c36f21 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c @@ -789,6 +789,16 @@ void dcn321_update_bw_bounding_box_fpu(struct dc *dc, struct clk_bw_params *bw_p dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16; } + /* bw_params->clk_table.entries[MAX_NUM_DPM_LVL]. + * MAX_NUM_DPM_LVL is 8. + * dcn3_02_soc.clock_limits[DC__VOLTAGE_STATES]. + * DC__VOLTAGE_STATES is 40. + */ + if (num_states > MAX_NUM_DPM_LVL) { + ASSERT(0); + return; + } + dcn3_21_soc.num_states = num_states; for (i = 0; i < dcn3_21_soc.num_states; i++) { dcn3_21_soc.clock_limits[i].state = i; -- 2.34.1

2 1