linux/drivers/gpu/drm/tegra
Kees Cook a2151490cc drm/dp: Fix OOB read when handling Post Cursor2 register
The link_status array was not large enough to read the Adjust Request
Post Cursor2 register, so remove the common helper function to avoid
an OOB read, found with a -Warray-bounds build:

drivers/gpu/drm/drm_dp_helper.c: In function 'drm_dp_get_adjust_request_post_cursor':
drivers/gpu/drm/drm_dp_helper.c:59:27: error: array subscript 10 is outside array bounds of 'const u8[6]' {aka 'const unsigned char[6]'} [-Werror=array-bounds]
   59 |         return link_status[r - DP_LANE0_1_STATUS];
      |                ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/drm_dp_helper.c:147:51: note: while referencing 'link_status'
  147 | u8 drm_dp_get_adjust_request_post_cursor(const u8 link_status[DP_LINK_STATUS_SIZE],
      |                                          ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Replace the only user of the helper with an open-coded fetch and decode,
similar to drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c.

Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@linux.ie>
Cc: dri-devel@lists.freedesktop.org
Fixes: 79465e0ffe ("drm/dp: Add helper to get post-cursor adjustments")
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Link: https://lore.kernel.org/r/20220105173507.2420910-1-keescook@chromium.org
Signed-off-by: Thierry Reding <treding@nvidia.com>
2022-02-25 10:24:20 +01:00
..
dc.c drm/tegra: dc: Support OPP and SoC core voltage scaling 2021-12-16 14:07:07 +01:00
dc.h drm/tegra: dc: Support OPP and SoC core voltage scaling 2021-12-16 14:07:07 +01:00
dp.c drm/dp: Fix OOB read when handling Post Cursor2 register 2022-02-25 10:24:20 +01:00
dp.h
dpaux.c drm/dp: Move public DisplayPort headers into dp/ 2022-01-17 11:25:44 +01:00
dpaux.h
drm.c Merge remote-tracking branch 'drm/drm-next' into drm-misc-next 2022-02-07 17:03:24 +01:00
drm.h drm/tegra: Add NVDEC driver 2021-12-16 14:07:06 +01:00
dsi.c drm/tegra: Fix reference leak when pm_runtime_get_sync() fails 2021-01-15 17:24:51 +01:00
dsi.h
falcon.c drm/tegra: falcon: Support newer VIC firmware 2021-01-15 17:15:50 +01:00
falcon.h
fb.c drm/tegra: Use fourcc_mod_is_vendor() helper 2021-08-16 12:19:21 +02:00
firewall.c drm/tegra: Add job firewall 2021-08-10 17:04:05 +02:00
gem.c drm/tegra: Implement buffer object cache 2021-12-16 14:07:06 +01:00
gem.h drm/tegra: Extract tegra_gem_lookup() 2021-08-10 14:44:31 +02:00
gr2d.c drm/tegra: Consolidate runtime PM management of older UAPI codepath 2021-12-16 14:07:08 +01:00
gr2d.h
gr3d.c drm/tegra: Consolidate runtime PM management of older UAPI codepath 2021-12-16 14:07:08 +01:00
gr3d.h
hda.c
hda.h
hdmi.c drm/tegra: hdmi: Add OPP support 2021-12-16 14:07:07 +01:00
hdmi.h
hub.c drm/tegra: hub: Implement basic scaling support 2021-05-31 14:30:11 +02:00
hub.h drm/tegra: Remove duplicate struct declaration 2021-12-16 14:07:07 +01:00
Kconfig drm-misc-next for v5.18: 2022-02-01 19:02:41 +10:00
Makefile drm/tegra: Add NVDEC driver 2021-12-16 14:07:06 +01:00
mipi-phy.c
mipi-phy.h
nvdec.c drm/tegra: Consolidate runtime PM management of older UAPI codepath 2021-12-16 14:07:08 +01:00
output.c drm/tegra: sor: Fix AUX device reference leak 2021-05-27 20:11:13 +02:00
plane.c drm/tegra: Propagate errors from drm_gem_plane_helper_prepare_fb() 2021-12-16 14:07:06 +01:00
plane.h drm/tegra: Implement correct DMA-BUF semantics 2021-12-16 14:07:06 +01:00
rgb.c drm/tegra: dc: rgb: Allow changing PLLD rate on Tegra30+ 2021-12-16 14:07:07 +01:00
sor.c drm/dp: Move public DisplayPort headers into dp/ 2022-01-17 11:25:44 +01:00
sor.h
submit.c drm/tegra: submit: Remove pm_runtime_enabled() checks 2021-12-16 14:07:08 +01:00
submit.h drm/tegra: Add job firewall 2021-08-10 17:04:05 +02:00
trace.c
trace.h
uapi.c drm/tegra: Implement buffer object cache 2021-12-16 14:07:06 +01:00
uapi.h drm/tegra: Implement correct DMA-BUF semantics 2021-12-16 14:07:06 +01:00
vic.c drm/tegra: Consolidate runtime PM management of older UAPI codepath 2021-12-16 14:07:08 +01:00
vic.h drm/tegra: Don't call SET_APPLICATION_ID in VIC boot 2021-06-11 18:48:36 +02:00