Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Harry Wentland d6590e3f76 drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async ... commit 6c92f6d960 upstream. [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results in a stack buffer overflow via memcpy. Additionally, link_index is used to dereference dc->links[] without bounds checking against dc->link_count, risking an out-of-bounds access. Replace the ASSERT with a hard runtime check that returns false when payload->length exceeds the destination buffer size, and add a bounds check for link_index before it is used. Assisted-by: GitHub Copilot:Claude claude-4-opus Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit ba4caa9fec) Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2026-06-01 17:35:48 +02:00
..
acp	drm: amd/acp: fix broken menu structure	2020-03-13 11:52:35 -04:00
amdgpu	drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)	2026-06-01 17:35:41 +02:00
amdkfd	drm/amdkfd: validate SVM ioctl nattr against buffer size	2026-06-01 17:35:25 +02:00
display	drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async	2026-06-01 17:35:48 +02:00
include	drm/amdgpu: Add additional DCE6 SCL registers	2025-10-19 16:21:42 +02:00
pm	drm/amd/pm/smu7: Add SCLK cap for quirky Hawaii board	2026-06-01 17:35:31 +02:00