linux-kernel - Re: [PATCH RESEND] drm/amd/display: Add sanity checks for drm_edid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CADnq5_MWVPJ5XXS_78Kv5ZRPUZe7vFtMYomcun5mKePBhMX2UA@mail.gmail.com>
Date: Mon, 23 Jun 2025 17:13:14 -0400
From: Alex Deucher <alexdeucher@...il.com>
To: Takashi Iwai <tiwai@...e.de>
Cc: amd-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org, 
	linux-kernel@...r.kernel.org, Harry Wentland <harry.wentland@....com>, 
	Leo Li <sunpeng.li@....com>, Alex Deucher <alexander.deucher@....com>, 
	Christian König <christian.koenig@....com>
Subject: Re: [PATCH RESEND] drm/amd/display: Add sanity checks for drm_edid_raw()

Applied.  Thanks!

Alex

On Mon, Jun 16, 2025 at 12:09 PM Takashi Iwai <tiwai@...e.de> wrote:
>
> When EDID is retrieved via drm_edid_raw(), it doesn't guarantee to
> return proper EDID bytes the caller wants: it may be either NULL (that
> leads to an Oops) or with too long bytes over the fixed size raw_edid
> array (that may lead to memory corruption).  The latter was reported
> actually when connected with a bad adapter.
>
> Add sanity checks for drm_edid_raw() to address the above corner
> cases, and return EDID_BAD_INPUT accordingly.
>
> Fixes: 48edb2a4256e ("drm/amd/display: switch amdgpu_dm_connector to use struct drm_edid")
> Link: https://bugzilla.suse.com/show_bug.cgi?id=1236415
> Signed-off-by: Takashi Iwai <tiwai@...e.de>
> ---
>
> Just resent, as the previous submission seems overlooked
>
>  drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
> index d4395b92fb85..9e3e51a2dc49 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
> @@ -1029,6 +1029,10 @@ enum dc_edid_status dm_helpers_read_local_edid(
>                         return EDID_NO_RESPONSE;
>
>                 edid = drm_edid_raw(drm_edid); // FIXME: Get rid of drm_edid_raw()
> +               if (!edid ||
> +                   edid->extensions >= sizeof(sink->dc_edid.raw_edid) / EDID_LENGTH)
> +                       return EDID_BAD_INPUT;
> +
>                 sink->dc_edid.length = EDID_LENGTH * (edid->extensions + 1);
>                 memmove(sink->dc_edid.raw_edid, (uint8_t *)edid, sink->dc_edid.length);
>
> --
> 2.49.0
>