Unverified Commit 378aab17 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11984 drm/amd/display: Add array index check for hdcp ddc access 

Merge Pull Request from: @ci-robot 
 
PR sync from: Bowen You <youbowen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ZUAEVNDIL2YLN5VMCGUWCFNI5SXI6YR2/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAU9O7 
 
Link:https://gitee.com/openeuler/kernel/pulls/11984

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 64941199 11fd6b84

drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c

+24 −4
Original line number Diff line number Diff line
@@ -156,11 +156,16 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp, 
	uint32_t cur_size = 0;

	uint32_t data_offset = 0;



	if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) {

	if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID ||

		msg_id >= MOD_HDCP_MESSAGE_ID_MAX)

		return MOD_HDCP_STATUS_DDC_FAILURE;

	}



	if (is_dp_hdcp(hdcp)) {

		int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) /

			sizeof(hdcp_dpcd_addrs[0]);

		if (msg_id >= num_dpcd_addrs)

			return MOD_HDCP_STATUS_DDC_FAILURE;



		while (buf_len > 0) {

			cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);

			success = hdcp->config.ddc.funcs.read_dpcd(hdcp->config.ddc.handle,
@@ -175,6 +180,11 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp, 
			data_offset += cur_size;

		}

	} else {

		int num_i2c_offsets = sizeof(hdcp_i2c_offsets) /

			sizeof(hdcp_i2c_offsets[0]);

		if (msg_id >= num_i2c_offsets)

			return MOD_HDCP_STATUS_DDC_FAILURE;



		success = hdcp->config.ddc.funcs.read_i2c(

				hdcp->config.ddc.handle,

				HDCP_I2C_ADDR,
@@ -219,11 +229,16 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp, 
	uint32_t cur_size = 0;

	uint32_t data_offset = 0;



	if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) {

	if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID ||

		msg_id >= MOD_HDCP_MESSAGE_ID_MAX)

		return MOD_HDCP_STATUS_DDC_FAILURE;

	}



	if (is_dp_hdcp(hdcp)) {

		int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) /

			sizeof(hdcp_dpcd_addrs[0]);

		if (msg_id >= num_dpcd_addrs)

			return MOD_HDCP_STATUS_DDC_FAILURE;



		while (buf_len > 0) {

			cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);

			success = hdcp->config.ddc.funcs.write_dpcd(
@@ -239,6 +254,11 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp, 
			data_offset += cur_size;

		}

	} else {

		int num_i2c_offsets = sizeof(hdcp_i2c_offsets) /

			sizeof(hdcp_i2c_offsets[0]);

		if (msg_id >= num_i2c_offsets)

			return MOD_HDCP_STATUS_DDC_FAILURE;



		hdcp->buf[0] = hdcp_i2c_offsets[msg_id];

		memmove(&hdcp->buf[1], buf, buf_len);

		success = hdcp->config.ddc.funcs.write_i2c(