Commit a2151490 authored by Kees Cook's avatar Kees Cook Committed by Thierry Reding
Browse files

drm/dp: Fix OOB read when handling Post Cursor2 register 



The link_status array was not large enough to read the Adjust Request
Post Cursor2 register, so remove the common helper function to avoid
an OOB read, found with a -Warray-bounds build:

drivers/gpu/drm/drm_dp_helper.c: In function 'drm_dp_get_adjust_request_post_cursor':
drivers/gpu/drm/drm_dp_helper.c:59:27: error: array subscript 10 is outside array bounds of 'const u8[6]' {aka 'const unsigned char[6]'} [-Werror=array-bounds]
   59 |         return link_status[r - DP_LANE0_1_STATUS];
      |                ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/drm_dp_helper.c:147:51: note: while referencing 'link_status'
  147 | u8 drm_dp_get_adjust_request_post_cursor(const u8 link_status[DP_LINK_STATUS_SIZE],
      |                                          ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Replace the only user of the helper with an open-coded fetch and decode,
similar to drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c.

Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@linux.ie>
Cc: dri-devel@lists.freedesktop.org
Fixes: 79465e0f ("drm/dp: Add helper to get post-cursor adjustments")
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: default avatarJani Nikula <jani.nikula@intel.com>
Link: https://lore.kernel.org/r/20220105173507.2420910-1-keescook@chromium.org


Signed-off-by: default avatarThierry Reding <treding@nvidia.com>
parent d4da1f27

drivers/gpu/drm/dp/drm_dp.c

+0 −10
Original line number Diff line number Diff line
@@ -145,16 +145,6 @@ u8 drm_dp_get_adjust_tx_ffe_preset(const u8 link_status[DP_LINK_STATUS_SIZE], 
}

EXPORT_SYMBOL(drm_dp_get_adjust_tx_ffe_preset);



u8 drm_dp_get_adjust_request_post_cursor(const u8 link_status[DP_LINK_STATUS_SIZE],

					 unsigned int lane)

{

	unsigned int offset = DP_ADJUST_REQUEST_POST_CURSOR2;

	u8 value = dp_link_status(link_status, offset);



	return (value >> (lane << 1)) & 0x3;

}

EXPORT_SYMBOL(drm_dp_get_adjust_request_post_cursor);



static int __8b10b_clock_recovery_delay_us(const struct drm_dp_aux *aux, u8 rd_interval)

{

	if (rd_interval > 4)

drivers/gpu/drm/tegra/dp.c

+10 −1
Original line number Diff line number Diff line
@@ -549,6 +549,15 @@ static void drm_dp_link_get_adjustments(struct drm_dp_link *link, 
{

	struct drm_dp_link_train_set *adjust = &link->train.adjust;

	unsigned int i;

	u8 post_cursor;

	int err;



	err = drm_dp_dpcd_read(link->aux, DP_ADJUST_REQUEST_POST_CURSOR2,

			       &post_cursor, sizeof(post_cursor));

	if (err < 0) {

		DRM_ERROR("failed to read post_cursor2: %d\n", err);

		post_cursor = 0;

	}



	for (i = 0; i < link->lanes; i++) {

		adjust->voltage_swing[i] =
@@ -560,7 +569,7 @@ static void drm_dp_link_get_adjustments(struct drm_dp_link *link, 
				DP_TRAIN_PRE_EMPHASIS_SHIFT;



		adjust->post_cursor[i] =

			drm_dp_get_adjust_request_post_cursor(status, i);

			(post_cursor >> (i << 1)) & 0x3;

	}

}

include/drm/dp/drm_dp_helper.h

+0 −2
Original line number Diff line number Diff line
@@ -1525,8 +1525,6 @@ u8 drm_dp_get_adjust_request_pre_emphasis(const u8 link_status[DP_LINK_STATUS_SI 
					  int lane);

u8 drm_dp_get_adjust_tx_ffe_preset(const u8 link_status[DP_LINK_STATUS_SIZE],

				   int lane);

u8 drm_dp_get_adjust_request_post_cursor(const u8 link_status[DP_LINK_STATUS_SIZE],

					 unsigned int lane);



#define DP_BRANCH_OUI_HEADER_SIZE	0xc

#define DP_RECEIVER_CAP_SIZE		0xf