From db7944458f4e5cdc11402e18ccbbc7aac4286f4b Mon Sep 17 00:00:00 2001 From: Luca Coelho Date: Tue, 9 Sep 2025 11:30:11 +0300 Subject: [PATCH] drm/i915/dmc: explicitly sanitize num_entries from package_header num_entries comes from package_header, which is read from an external firmware blob and thus untrusted. In parse_dmc_fw_package() we assign package_header->num_entries to a local variable, but the range check still uses the struct field directly. Switch the check to use the local copy instead. This makes the sanitization explicit and avoids a redundant dereference. Reviewed-by: Mitul Golani Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/20250909083042.1292672-1-luciano.coelho@intel.com --- drivers/gpu/drm/i915/display/intel_dmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/display/intel_dmc.c b/drivers/gpu/drm/i915/display/intel_dmc.c index 77a0199f9ea5f..517bebb0b4aac 100644 --- a/drivers/gpu/drm/i915/display/intel_dmc.c +++ b/drivers/gpu/drm/i915/display/intel_dmc.c @@ -1141,7 +1141,7 @@ parse_dmc_fw_package(struct intel_dmc *dmc, } num_entries = package_header->num_entries; - if (WARN_ON(package_header->num_entries > max_entries)) + if (WARN_ON(num_entries > max_entries)) num_entries = max_entries; fw_info = (const struct intel_fw_info *) -- 2.47.3