Commit 68433303 authored by Alex Hung's avatar Alex Hung Committed by Yuntao Liu
Browse files

drm/amd/display: Check msg_id before processing transcation 

stable inclusion
from stable-v5.10.226
commit 916083054670060023d3f8a8ace895d710e268f4
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9XW
CVE: CVE-2024-46814

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=916083054670060023d3f8a8ace895d710e268f4



--------------------------------

[ Upstream commit fa71face755e27dc44bc296416ebdf2c67163316 ]

[WHY & HOW]
HDCP_MESSAGE_ID_INVALID (-1) is not a valid msg_id nor is it a valid
array index, and it needs checking before used.

This fixes 4 OVERRUN issues reported by Coverity.

Reviewed-by: default avatarHarry Wentland <harry.wentland@amd.com>
Acked-by: default avatarTom Chung <chiahsuan.chung@amd.com>
Signed-off-by: default avatarAlex Hung <alex.hung@amd.com>
Tested-by: default avatarDaniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarYuntao Liu <liuyuntao12@huawei.com>
parent 0988d5e5

drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c

+15 −2
Original line number Diff line number Diff line
@@ -130,13 +130,21 @@ static bool hdmi_14_process_transaction( 
	const uint8_t hdcp_i2c_addr_link_primary = 0x3a; /* 0x74 >> 1*/

	const uint8_t hdcp_i2c_addr_link_secondary = 0x3b; /* 0x76 >> 1*/

	struct i2c_command i2c_command;

	uint8_t offset = hdcp_i2c_offsets[message_info->msg_id];

	uint8_t offset;

	struct i2c_payload i2c_payloads[] = {

		{ true, 0, 1, &offset },

		{ true, 0, 1, 0 },

		/* actual hdcp payload, will be filled later, zeroed for now*/

		{ 0 }

	};



	if (message_info->msg_id == HDCP_MESSAGE_ID_INVALID) {

		DC_LOG_ERROR("%s: Invalid message_info msg_id - %d\n", __func__, message_info->msg_id);

		return false;

	}



	offset = hdcp_i2c_offsets[message_info->msg_id];

	i2c_payloads[0].data = &offset;



	switch (message_info->link) {

	case HDCP_LINK_SECONDARY:

		i2c_payloads[0].address = hdcp_i2c_addr_link_secondary;
@@ -310,6 +318,11 @@ static bool dp_11_process_transaction( 
	struct dc_link *link,

	struct hdcp_protection_message *message_info)

{

	if (message_info->msg_id == HDCP_MESSAGE_ID_INVALID) {

		DC_LOG_ERROR("%s: Invalid message_info msg_id - %d\n", __func__, message_info->msg_id);

		return false;

	}



	return dpcd_access_helper(

		link,

		message_info->length,