drm/amd/display: Avoid HDCP over-read and corruption

Browse source

[ Upstream commit 06888d571b ]

Instead of reading the desired 5 bytes of the actual target field,
the code was reading 8. This could result in a corrupted value if the
trailing 3 bytes were non-zero, so instead use an appropriately sized
and zero-initialized bounce buffer, and read only 5 bytes before casting
to u64.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Kees Cook 2021-05-28 10:53:54 -07:00 • committed by Greg Kroah-Hartman

parent 060a3b127d

commit 3b2b93a485

1 changed files with 3 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c

View file