MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-17 06:39:37 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

drm/amd/display: Check msg_id before processing transcation

Browse Source 
[ Upstream commit fa71face75 ]

[WHY & HOW]
HDCP_MESSAGE_ID_INVALID (-1) is not a valid msg_id nor is it a valid
array index, and it needs checking before used.

This fixes 4 OVERRUN issues reported by Coverity.

Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Alex Hung 2024-04-16 16:47:42 -06:00 committed by Greg Kroah-Hartman
parent 21f9cb44f8
commit cb63090a17
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c
View File

@ -130,13 +130,21 @@ static bool hdmi_14_process_transaction(
const uint8_t hdcp_i2c_addr_link_primary = 0x3a; /* 0x74 >> 1*/
const uint8_t hdcp_i2c_addr_link_secondary = 0x3b; /* 0x76 >> 1*/
struct i2c_command i2c_command;
uint8_t offset = hdcp_i2c_offsets[message_info->msg_id];
uint8_t offset;
struct i2c_payload i2c_payloads[] = {
{ true, 0, 1, &offset },
{ true, 0, 1, 0 },
/* actual hdcp payload, will be filled later, zeroed for now*/
{ 0 }
};
if (message_info->msg_id == HDCP_MESSAGE_ID_INVALID) {
DC_LOG_ERROR("%s: Invalid message_info msg_id - %d\n", __func__, message_info->msg_id);
return false;
}
offset = hdcp_i2c_offsets[message_info->msg_id];
i2c_payloads[0].data = &offset;
switch (message_info->link) {
case HDCP_LINK_SECONDARY:
i2c_payloads[0].address = hdcp_i2c_addr_link_secondary;
@ -310,6 +318,11 @@ static bool dp_11_process_transaction(
struct dc_link *link,
struct hdcp_protection_message *message_info)
{
if (message_info->msg_id == HDCP_MESSAGE_ID_INVALID) {
DC_LOG_ERROR("%s: Invalid message_info msg_id - %d\n", __func__, message_info->msg_id);
return false;
}
return dpcd_access_helper(
link,
message_info->length,