lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 18 Dec 2022 11:15:44 -0500 From: Sasha Levin <sashal@...nel.org> To: linux-kernel@...r.kernel.org, stable@...r.kernel.org Cc: Aurabindo Pillai <aurabindo.pillai@....com>, Martin Leung <Martin.Leung@....com>, Tom Chung <chiahsuan.chung@....com>, Daniel Wheeler <daniel.wheeler@....com>, Alex Deucher <alexander.deucher@....com>, Sasha Levin <sashal@...nel.org>, harry.wentland@....com, sunpeng.li@....com, Rodrigo.Siqueira@....com, christian.koenig@....com, Xinhui.Pan@....com, airlied@...il.com, daniel@...ll.ch, Charlene.Liu@....com, sancchen@....com, jaehyun.chung@....com, tales.aparecida@...il.com, amd-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org Subject: [PATCH AUTOSEL 5.10 24/39] drm/amd/display: fix array index out of bound error in bios parser From: Aurabindo Pillai <aurabindo.pillai@....com> [ Upstream commit 4fc1ba4aa589ca267468ad23fedef37562227d32 ] [Why&How] Firmware headers dictate that gpio_pin array only has a size of 8. The count returned from vbios however is greater than 8. Fix this by not using array indexing but incrementing the pointer since gpio_pin definition in atomfirmware.h is hardcoded to size 8 Reviewed-by: Martin Leung <Martin.Leung@....com> Acked-by: Tom Chung <chiahsuan.chung@....com> Signed-off-by: Aurabindo Pillai <aurabindo.pillai@....com> Tested-by: Daniel Wheeler <daniel.wheeler@....com> Signed-off-by: Alex Deucher <alexander.deucher@....com> Signed-off-by: Sasha Levin <sashal@...nel.org> --- .../gpu/drm/amd/display/dc/bios/bios_parser2.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c index 29d64e7e304f..930d2b7d3448 100644 --- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c @@ -352,6 +352,7 @@ static enum bp_result get_gpio_i2c_info( uint32_t count = 0; unsigned int table_index = 0; bool find_valid = false; + struct atom_gpio_pin_assignment *pin; if (!info) return BP_RESULT_BADINPUT; @@ -379,20 +380,17 @@ static enum bp_result get_gpio_i2c_info( - sizeof(struct atom_common_table_header)) / sizeof(struct atom_gpio_pin_assignment); + pin = (struct atom_gpio_pin_assignment *) header->gpio_pin; + for (table_index = 0; table_index < count; table_index++) { - if (((record->i2c_id & I2C_HW_CAP) == ( - header->gpio_pin[table_index].gpio_id & - I2C_HW_CAP)) && - ((record->i2c_id & I2C_HW_ENGINE_ID_MASK) == - (header->gpio_pin[table_index].gpio_id & - I2C_HW_ENGINE_ID_MASK)) && - ((record->i2c_id & I2C_HW_LANE_MUX) == - (header->gpio_pin[table_index].gpio_id & - I2C_HW_LANE_MUX))) { + if (((record->i2c_id & I2C_HW_CAP) == (pin->gpio_id & I2C_HW_CAP)) && + ((record->i2c_id & I2C_HW_ENGINE_ID_MASK) == (pin->gpio_id & I2C_HW_ENGINE_ID_MASK)) && + ((record->i2c_id & I2C_HW_LANE_MUX) == (pin->gpio_id & I2C_HW_LANE_MUX))) { /* still valid */ find_valid = true; break; } + pin = (struct atom_gpio_pin_assignment *)((uint8_t *)pin + sizeof(struct atom_gpio_pin_assignment)); } /* If we don't find the entry that we are looking for then -- 2.35.1
Powered by blists - more mailing lists