⬢ DragonFlyBSD Kernel Audit
DF-3908 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c
+++ b/sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c
@@ -1494,8 +1494,14 @@
 
 	memset(&arb_regs, 0x00, sizeof(SMU72_Discrete_MCArbDramTimingTable));
 
-	for (i = 0; i < data->dpm_table.sclk_table.count; i++) {
-		for (j = 0; j < data->dpm_table.mclk_table.count; j++) {
+	/* arb_regs is a fixed [SMU72_MAX_LEVELS_GRAPHICS][SMU72_MAX_LEVELS_MEMORY]
+	 * stack table; the VBIOS-controlled DPM counts are only bounded by the
+	 * dependency-table entry count (u8) and must be clamped before indexing.
+	 */
+	for (i = 0; i < MIN(data->dpm_table.sclk_table.count,
+			    SMU72_MAX_LEVELS_GRAPHICS); i++) {
+		for (j = 0; j < MIN(data->dpm_table.mclk_table.count,
+				    SMU72_MAX_LEVELS_MEMORY); j++) {
 			result = tonga_populate_memory_timing_parameters
 				(hwmgr, data->dpm_table.sclk_table.dpm_levels[i].value,
 				 data->dpm_table.mclk_table.dpm_levels[j].value,