MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-07 18:05:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

drm/amd/display: Add array index check for hdcp ddc access

Browse Source 
[ Upstream commit 4e70c0f525 ]

[Why]
Coverity reports OVERRUN warning. Do not check if array
index valid.

[How]
Check msg_id valid and valid array index.

Reviewed-by: Alex Hung <alex.hung@amd.com>
Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Hersen Wu <hersenxs.wu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Hersen Wu 2024-04-24 10:09:31 -04:00 committed by Greg Kroah-Hartman
parent 48e0b68e23
commit 8b5ccf3d01
1 changed files with 24 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c
View File

@ -156,11 +156,16 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp,
uint32_t cur_size = 0;
uint32_t data_offset = 0;
if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) {
if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID ||
msg_id >= MOD_HDCP_MESSAGE_ID_MAX)
return MOD_HDCP_STATUS_DDC_FAILURE;
}
if (is_dp_hdcp(hdcp)) {
int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) /
sizeof(hdcp_dpcd_addrs[0]);
if (msg_id >= num_dpcd_addrs)
return MOD_HDCP_STATUS_DDC_FAILURE;
while (buf_len > 0) {
cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);
success = hdcp->config.ddc.funcs.read_dpcd(hdcp->config.ddc.handle,
@ -175,6 +180,11 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp,
data_offset += cur_size;
}
} else {
int num_i2c_offsets = sizeof(hdcp_i2c_offsets) /
sizeof(hdcp_i2c_offsets[0]);
if (msg_id >= num_i2c_offsets)
return MOD_HDCP_STATUS_DDC_FAILURE;
success = hdcp->config.ddc.funcs.read_i2c(
hdcp->config.ddc.handle,
HDCP_I2C_ADDR,
@ -219,11 +229,16 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp,
uint32_t cur_size = 0;
uint32_t data_offset = 0;
if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) {
if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID ||
msg_id >= MOD_HDCP_MESSAGE_ID_MAX)
return MOD_HDCP_STATUS_DDC_FAILURE;
}
if (is_dp_hdcp(hdcp)) {
int num_dpcd_addrs = sizeof(hdcp_dpcd_addrs) /
sizeof(hdcp_dpcd_addrs[0]);
if (msg_id >= num_dpcd_addrs)
return MOD_HDCP_STATUS_DDC_FAILURE;
while (buf_len > 0) {
cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);
success = hdcp->config.ddc.funcs.write_dpcd(
@ -239,6 +254,11 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp,
data_offset += cur_size;
}
} else {
int num_i2c_offsets = sizeof(hdcp_i2c_offsets) /
sizeof(hdcp_i2c_offsets[0]);
if (msg_id >= num_i2c_offsets)
return MOD_HDCP_STATUS_DDC_FAILURE;
hdcp->buf[0] = hdcp_i2c_offsets[msg_id];
memmove(&hdcp->buf[1], buf, buf_len);
success = hdcp->config.ddc.funcs.write_i2c(