drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers

Three sideband reply parsers read 16-bit fields as:

  val = (raw->msg[idx] << 8) | (raw->msg[idx+1]);

and check bounds only after the fact. When idx == raw->curlen,
raw->msg[idx+1] reads one byte past the received message data into
the following struct fields (curchunk_len, curchunk_idx, curlen).

Affected functions:
 - drm_dp_sideband_parse_enum_path_resources_ack()
   full_payload_bw_number and avail_payload_bw_number fields
 - drm_dp_sideband_parse_allocate_payload_ack()
   allocated_pbn field
 - drm_dp_sideband_parse_query_payload_ack()
   allocated_pbn field

Fix by using a single combined check (idx + 2 > curlen) before each
2-byte read. Since the check is strictly tighter than idx > curlen,
no separate step is needed.

Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
Cc: <stable@vger.kernel.org> # v3.17+
Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
[added fixes tag]
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patch.msgid.link/20260510203128.2884846-1-ashutoshdesai993@gmail.com

diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c
index 2ca1f2e9712ceb6ad54866a5433abbdb1ade9ffe..4de36fda0544008a83a951410cae41b61e4c0ef0 100644 (file)
--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
@@ -934,16 +934,13 @@ static bool drm_dp_sideband_parse_enum_path_resources_ack(struct drm_dp_sideband
        repmsg->u.path_resources.port_number = (raw->msg[idx] >> 4) & 0xf;
        repmsg->u.path_resources.fec_capable = raw->msg[idx] & 0x1;
        idx++;
-       if (idx > raw->curlen)
+       if (idx + 2 > raw->curlen)
                goto fail_len;
        repmsg->u.path_resources.full_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
        idx += 2;
-       if (idx > raw->curlen)
+       if (idx + 2 > raw->curlen)
                goto fail_len;
        repmsg->u.path_resources.avail_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
-       idx += 2;
-       if (idx > raw->curlen)
-               goto fail_len;
        return true;
 fail_len:
        DRM_DEBUG_KMS("enum resource parse length fail %d %d\n", idx, raw->curlen);
@@ -961,12 +958,9 @@ static bool drm_dp_sideband_parse_allocate_payload_ack(struct drm_dp_sideband_ms
                goto fail_len;
        repmsg->u.allocate_payload.vcpi = raw->msg[idx];
        idx++;
-       if (idx > raw->curlen)
+       if (idx + 2 > raw->curlen)
                goto fail_len;
        repmsg->u.allocate_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
-       idx += 2;
-       if (idx > raw->curlen)
-               goto fail_len;
        return true;
 fail_len:
        DRM_DEBUG_KMS("allocate payload parse length fail %d %d\n", idx, raw->curlen);
@@ -980,12 +974,9 @@ static bool drm_dp_sideband_parse_query_payload_ack(struct drm_dp_sideband_msg_r
 
        repmsg->u.query_payload.port_number = (raw->msg[idx] >> 4) & 0xf;
        idx++;
-       if (idx > raw->curlen)
+       if (idx + 2 > raw->curlen)
                goto fail_len;
        repmsg->u.query_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx + 1]);
-       idx += 2;
-       if (idx > raw->curlen)
-               goto fail_len;
        return true;
 fail_len:
        DRM_DEBUG_KMS("query payload parse length fail %d %d\n", idx, raw->curlen);