From 336cf6d80d41457442b659e7ba7a7badc0ffe79d Mon Sep 17 00:00:00 2001 From: Jani Nikula Date: Mon, 3 Aug 2026 21:24:15 -0400 Subject: [PATCH] drm/i915/hdcp: check streams[] bounds before overflow [ Upstream commit bbb15a6b042d02e5508a02b4847e02d2579ee7bc ] The data->streams[] overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a backtrace might be overkill here, but prefer not changing the behaviour other than not doing the overrun. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo Fixes: e03187e12cae ("drm/i915/hdcp: MST streams support in hdcp port_data") Cc: stable@vger.kernel.org # v5.12+ Cc: Anshuman Gupta Cc: Suraj Kandpal Reviewed-by: Suraj Kandpal Link: https://patch.msgid.link/20260625170304.1104723-1-jani.nikula@intel.com Signed-off-by: Jani Nikula (cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd) Signed-off-by: Joonas Lahtinen Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/display/intel_hdcp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/display/intel_hdcp.c b/drivers/gpu/drm/i915/display/intel_hdcp.c index ebc2e32aec0b..cc159d926145 100644 --- a/drivers/gpu/drm/i915/display/intel_hdcp.c +++ b/drivers/gpu/drm/i915/display/intel_hdcp.c @@ -89,6 +89,9 @@ intel_hdcp_required_content_stream(struct intel_digital_port *dig_port) if (!enforce_type0 && !intel_streams_type1_capable(connector)) enforce_type0 = true; + if (drm_WARN_ON(&i915->drm, data->k >= INTEL_NUM_PIPES(i915))) + return -EINVAL; + data->streams[data->k].stream_id = intel_conn_to_vcpi(connector); data->k++; @@ -98,7 +101,7 @@ intel_hdcp_required_content_stream(struct intel_digital_port *dig_port) } drm_connector_list_iter_end(&conn_iter); - if (drm_WARN_ON(&i915->drm, data->k > INTEL_NUM_PIPES(i915) || data->k == 0)) + if (drm_WARN_ON(&i915->drm, !data->k)) return -EINVAL; /*