]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drm/i915/dmc: explicitly sanitize num_entries from package_header
authorLuca Coelho <luciano.coelho@intel.com>
Tue, 9 Sep 2025 08:30:11 +0000 (11:30 +0300)
committerLuca Coelho <luciano.coelho@intel.com>
Fri, 19 Sep 2025 09:50:56 +0000 (12:50 +0300)
commitdb7944458f4e5cdc11402e18ccbbc7aac4286f4b
tree3ced26fe4c11d0af736c4c85c642ebdf7a75b292
parentcef58ce505a04a896d59cb207f0a0ccea1eec5ca
drm/i915/dmc: explicitly sanitize num_entries from package_header

num_entries comes from package_header, which is read from an external
firmware blob and thus untrusted.  In parse_dmc_fw_package() we assign
package_header->num_entries to a local variable, but the range check
still uses the struct field directly.

Switch the check to use the local copy instead.  This makes the
sanitization explicit and avoids a redundant dereference.

Reviewed-by: Mitul Golani <mitulkumar.ajitkumar.golani@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/20250909083042.1292672-1-luciano.coelho@intel.com
drivers/gpu/drm/i915/display/intel_dmc.c