⬢ DragonFlyBSD Kernel Audit
DF-3684 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -4622,14 +4622,16 @@
 		if (table_info == NULL || table_info->vdd_dep_on_sclk == NULL)
 			return -EINVAL;
 		dep_sclk_table = table_info->vdd_dep_on_sclk;
-		for (i = 0; i < dep_sclk_table->count; i++)
+		for (i = 0; i < dep_sclk_table->count && i < MAX_NUM_CLOCKS; i++)
 			clocks->clock[i] = dep_sclk_table->entries[i].clk * 10;
-		clocks->count = dep_sclk_table->count;
+		clocks->count = i;
 	} else if (hwmgr->pp_table_version == PP_TABLE_V0) {
 		sclk_table = hwmgr->dyn_state.vddc_dependency_on_sclk;
-		for (i = 0; i < sclk_table->count; i++)
+		if (sclk_table == NULL)
+			return -EINVAL;
+		for (i = 0; i < sclk_table->count && i < MAX_NUM_CLOCKS; i++)
 			clocks->clock[i] = sclk_table->entries[i].clk * 10;
-		clocks->count = sclk_table->count;
+		clocks->count = i;
 	}
 
 	return 0;
@@ -4659,17 +4661,21 @@
 		if (table_info == NULL)
 			return -EINVAL;
 		dep_mclk_table = table_info->vdd_dep_on_mclk;
-		for (i = 0; i < dep_mclk_table->count; i++) {
+		if (dep_mclk_table == NULL)
+			return -EINVAL;
+		for (i = 0; i < dep_mclk_table->count && i < MAX_NUM_CLOCKS; i++) {
 			clocks->clock[i] = dep_mclk_table->entries[i].clk * 10;
 			clocks->latency[i] = smu7_get_mem_latency(hwmgr,
 						dep_mclk_table->entries[i].clk);
 		}
-		clocks->count = dep_mclk_table->count;
+		clocks->count = i;
 	} else if (hwmgr->pp_table_version == PP_TABLE_V0) {
 		mclk_table = hwmgr->dyn_state.vddc_dependency_on_mclk;
-		for (i = 0; i < mclk_table->count; i++)
+		if (mclk_table == NULL)
+			return -EINVAL;
+		for (i = 0; i < mclk_table->count && i < MAX_NUM_CLOCKS; i++)
 			clocks->clock[i] = mclk_table->entries[i].clk * 10;
-		clocks->count = mclk_table->count;
+		clocks->count = i;
 	}
 	return 0;
 }