kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/drivers/gpu/drm/amd/display/modules
History
Harry Wentland f0f3981c43 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size 
[Why & How]
During HDCP 2.x repeater authentication over HDMI, the driver reads the
sink's RxStatus register and extracts a 10-bit message size field (max
value 1023). This value is used as the read length for the ReceiverID
list without being clamped to the size of the destination buffer
rx_id_list[177]. A malicious HDMI repeater could advertise a message
size larger than the buffer, causing an out-of-bounds write during the
I2C read.

Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the
rx_id_list buffer, matching the approach already used in the DP branch.

Fixes: eff682f83c ("drm/amd/display: Add DDC handles for HDCP2.2")
Assisted-by: Copilot:claude-opus-4.6
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 229212219e)
Cc: stable@vger.kernel.org
History 2026-06-03 14:45:23 -04:00
..
color drm/amd/display: Fix Silence warnings 2026-03-23 14:15:31 -04:00
freesync drm/amd/display: Fix implicit narrowing conversions in modules 2026-04-17 15:21:29 -04:00
hdcp drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size 2026-06-03 14:45:23 -04:00
inc drm/amd/display: Revise VSC SDP header for Panel Replay 2025-12-08 13:56:36 -05:00
info_packet drm/amd/display: Revise VSC SDP header for Panel Replay 2025-12-08 13:56:36 -05:00
power drm/amd/display: Fix implicit narrowing conversions in modules 2026-04-17 15:21:29 -04:00
vmid drm/amd/display: Fix implicit narrowing conversions in modules 2026-04-17 15:21:29 -04:00