Unverified Commit 58d44ef1 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11976 CVE-2024-46814 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yuntao Liu <liuyuntao12@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/VTOEYMBGPAFUQOFMDVU5NXXQC3FV2PGA/ 
CVE-2024-46814

Alex Hung (1):
  drm/amd/display: Check msg_id before processing transcation


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IAU9XW 
 
Link:https://gitee.com/openeuler/kernel/pulls/11976

 

Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 8c19e1ea 68433303

drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c

+15 −2
Original line number Diff line number Diff line
@@ -130,13 +130,21 @@ static bool hdmi_14_process_transaction( 
	const uint8_t hdcp_i2c_addr_link_primary = 0x3a; /* 0x74 >> 1*/

	const uint8_t hdcp_i2c_addr_link_secondary = 0x3b; /* 0x76 >> 1*/

	struct i2c_command i2c_command;

	uint8_t offset = hdcp_i2c_offsets[message_info->msg_id];

	uint8_t offset;

	struct i2c_payload i2c_payloads[] = {

		{ true, 0, 1, &offset },

		{ true, 0, 1, 0 },

		/* actual hdcp payload, will be filled later, zeroed for now*/

		{ 0 }

	};



	if (message_info->msg_id == HDCP_MESSAGE_ID_INVALID) {

		DC_LOG_ERROR("%s: Invalid message_info msg_id - %d\n", __func__, message_info->msg_id);

		return false;

	}



	offset = hdcp_i2c_offsets[message_info->msg_id];

	i2c_payloads[0].data = &offset;



	switch (message_info->link) {

	case HDCP_LINK_SECONDARY:

		i2c_payloads[0].address = hdcp_i2c_addr_link_secondary;
@@ -310,6 +318,11 @@ static bool dp_11_process_transaction( 
	struct dc_link *link,

	struct hdcp_protection_message *message_info)

{

	if (message_info->msg_id == HDCP_MESSAGE_ID_INVALID) {

		DC_LOG_ERROR("%s: Invalid message_info msg_id - %d\n", __func__, message_info->msg_id);

		return false;

	}



	return dpcd_access_helper(

		link,

		message_info->length,