Commit 9e499b42 authored Aug 18, 2024 by Alex Hung Committed by Li Nan Aug 18, 2024

drm/amd/display: Check index msg_id before read or write

stable inclusion
from stable-v5.10.222
commit b5b8837d066cc182ff69fb5629ad32ade5484567
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSSE
CVE: CVE-2024-42121

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b5b8837d066cc182ff69fb5629ad32ade5484567



--------------------------------

[ Upstream commit 59d99deb330af206a4541db0c4da8f73880fba03 ]

[WHAT]
msg_id is used as an array index and it cannot be a negative value, and
therefore cannot be equal to MOD_HDCP_MESSAGE_ID_INVALID (-1).

[HOW]
Check whether msg_id is valid before reading and setting.

This fixes 4 OVERRUN issues reported by Coverity.

Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
Acked-by: Wayne Lin <wayne.lin@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Li Nan <linan122@huawei.com>

parent 9560420d

drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c

+8 −0

Original line number	Diff line number	Diff line
		@@ -156,6 +156,10 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp,
		uint32_t cur_size = 0;
		uint32_t data_offset = 0;

		if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) {
		return MOD_HDCP_STATUS_DDC_FAILURE;
		}

		if (is_dp_hdcp(hdcp)) {
		while (buf_len > 0) {
		cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);
		@@ -215,6 +219,10 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp,
		uint32_t cur_size = 0;
		uint32_t data_offset = 0;

		if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) {
		return MOD_HDCP_STATUS_DDC_FAILURE;
		}

		if (is_dp_hdcp(hdcp)) {
		while (buf_len > 0) {
		cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);