--- /dev/null
+From 55bd5e685bda455b9b50c835f8c8442d52a344a3 Mon Sep 17 00:00:00 2001
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Date: Fri, 10 Apr 2026 04:19:01 +0000
+Subject: drm/dp/mst: fix buffer overflows in sideband chunk accumulation
+
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+
+commit 55bd5e685bda455b9b50c835f8c8442d52a344a3 upstream.
+
+drm_dp_sideband_append_payload() has three related bugs when processing
+device-provided sideband reply data:
+
+1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken
+ directly from the DP sideband header. If a device sends msg_len=0,
+ curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len)
+ is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow).
+ drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy()
+ writes 255 bytes into msg[], both far out of bounds.
+
+2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is
+ only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks
+ until curchunk_idx reaches curchunk_len, writing up to 15 bytes past
+ the end of chunk[] into msg[].
+
+3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to
+ msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256],
+ so the memcpy can spill into adjacent struct fields.
+
+All three are reachable from any DP MST device that can forge sideband
+reply messages on a physical connection.
+
+Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
+Cc: <stable@vger.kernel.org> # v3.17+
+Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patch.msgid.link/20260410041901.2438960-1-ashutoshdesai993@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -779,6 +779,12 @@ static bool drm_dp_sideband_append_paylo
+ {
+ u8 crc4;
+
++ /* curchunk_len must be >= 1 (min 1 CRC byte) and fit in chunk[] */
++ if (!msg->curchunk_len ||
++ msg->curchunk_len > ARRAY_SIZE(msg->chunk) ||
++ msg->curchunk_idx + replybuflen > ARRAY_SIZE(msg->chunk))
++ return false;
++
+ memcpy(&msg->chunk[msg->curchunk_idx], replybuf, replybuflen);
+ msg->curchunk_idx += replybuflen;
+
+@@ -789,6 +795,9 @@ static bool drm_dp_sideband_append_paylo
+ print_hex_dump(KERN_DEBUG, "wrong crc",
+ DUMP_PREFIX_NONE, 16, 1,
+ msg->chunk, msg->curchunk_len, false);
++ /* Guard against accumulated msg[] overflow */
++ if (msg->curlen + msg->curchunk_len - 1 > ARRAY_SIZE(msg->msg))
++ return false;
+ /* copy chunk into bigger msg */
+ memcpy(&msg->msg[msg->curlen], msg->chunk, msg->curchunk_len - 1);
+ msg->curlen += msg->curchunk_len - 1;
--- /dev/null
+From 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 Mon Sep 17 00:00:00 2001
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Date: Sun, 10 May 2026 20:17:33 +0000
+Subject: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
+
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+
+commit 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 upstream.
+
+drm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw
+message and then unconditionally does:
+
+ memcpy(bytes, &raw->msg[idx], num_bytes);
+
+without checking that idx + num_bytes <= raw->curlen. raw->msg[] is
+256 bytes; if a malicious or misbehaving MST hub sets num_bytes larger
+than the remaining payload, the memcpy reads past the received data
+into whatever follows in raw->msg[].
+
+drm_dp_sideband_parse_remote_i2c_read_ack() has the same flaw (noted
+with a /* TODO check */ comment since the code was introduced).
+
+Fix both functions by using a single combined check
+(idx + num_bytes > curlen) before each memcpy. Since num_bytes is u8,
+it is always >= 0, so this strictly subsumes the simpler idx > curlen
+form and no separate step is needed.
+
+Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
+Cc: <stable@vger.kernel.org> # v3.17+
+Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+[added missing fixes tag]
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patch.msgid.link/20260510201733.2882224-1-ashutoshdesai993@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -861,7 +861,7 @@ static bool drm_dp_sideband_parse_remote
+ goto fail_len;
+ repmsg->u.remote_dpcd_read_ack.num_bytes = raw->msg[idx];
+ idx++;
+- if (idx > raw->curlen)
++ if (idx + repmsg->u.remote_dpcd_read_ack.num_bytes > raw->curlen)
+ goto fail_len;
+
+ memcpy(repmsg->u.remote_dpcd_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_dpcd_read_ack.num_bytes);
+@@ -897,7 +897,9 @@ static bool drm_dp_sideband_parse_remote
+ goto fail_len;
+ repmsg->u.remote_i2c_read_ack.num_bytes = raw->msg[idx];
+ idx++;
+- /* TODO check */
++ if (idx + repmsg->u.remote_i2c_read_ack.num_bytes > raw->curlen)
++ goto fail_len;
++
+ memcpy(repmsg->u.remote_i2c_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_i2c_read_ack.num_bytes);
+ return true;
+ fail_len:
--- /dev/null
+From 6b89ba3dba2f583626fb693e47e951ffb8bf591f Mon Sep 17 00:00:00 2001
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Date: Sun, 10 May 2026 20:31:28 +0000
+Subject: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
+
+From: Ashutosh Desai <ashutoshdesai993@gmail.com>
+
+commit 6b89ba3dba2f583626fb693e47e951ffb8bf591f upstream.
+
+Three sideband reply parsers read 16-bit fields as:
+
+ val = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
+
+and check bounds only after the fact. When idx == raw->curlen,
+raw->msg[idx+1] reads one byte past the received message data into
+the following struct fields (curchunk_len, curchunk_idx, curlen).
+
+Affected functions:
+ - drm_dp_sideband_parse_enum_path_resources_ack()
+ full_payload_bw_number and avail_payload_bw_number fields
+ - drm_dp_sideband_parse_allocate_payload_ack()
+ allocated_pbn field
+ - drm_dp_sideband_parse_query_payload_ack()
+ allocated_pbn field
+
+Fix by using a single combined check (idx + 2 > curlen) before each
+2-byte read. Since the check is strictly tighter than idx > curlen,
+no separate step is needed.
+
+Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)")
+Cc: <stable@vger.kernel.org> # v3.17+
+Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+[added fixes tag]
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patch.msgid.link/20260510203128.2884846-1-ashutoshdesai993@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 17 ++++-------------
+ 1 file changed, 4 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -924,16 +924,13 @@ static bool drm_dp_sideband_parse_enum_p
+ repmsg->u.path_resources.port_number = (raw->msg[idx] >> 4) & 0xf;
+ repmsg->u.path_resources.fec_capable = raw->msg[idx] & 0x1;
+ idx++;
+- if (idx > raw->curlen)
++ if (idx + 2 > raw->curlen)
+ goto fail_len;
+ repmsg->u.path_resources.full_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
+ idx += 2;
+- if (idx > raw->curlen)
++ if (idx + 2 > raw->curlen)
+ goto fail_len;
+ repmsg->u.path_resources.avail_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
+- idx += 2;
+- if (idx > raw->curlen)
+- goto fail_len;
+ return true;
+ fail_len:
+ DRM_DEBUG_KMS("enum resource parse length fail %d %d\n", idx, raw->curlen);
+@@ -951,12 +948,9 @@ static bool drm_dp_sideband_parse_alloca
+ goto fail_len;
+ repmsg->u.allocate_payload.vcpi = raw->msg[idx];
+ idx++;
+- if (idx > raw->curlen)
++ if (idx + 2 > raw->curlen)
+ goto fail_len;
+ repmsg->u.allocate_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
+- idx += 2;
+- if (idx > raw->curlen)
+- goto fail_len;
+ return true;
+ fail_len:
+ DRM_DEBUG_KMS("allocate payload parse length fail %d %d\n", idx, raw->curlen);
+@@ -970,12 +964,9 @@ static bool drm_dp_sideband_parse_query_
+
+ repmsg->u.query_payload.port_number = (raw->msg[idx] >> 4) & 0xf;
+ idx++;
+- if (idx > raw->curlen)
++ if (idx + 2 > raw->curlen)
+ goto fail_len;
+ repmsg->u.query_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx + 1]);
+- idx += 2;
+- if (idx > raw->curlen)
+- goto fail_len;
+ return true;
+ fail_len:
+ DRM_DEBUG_KMS("query payload parse length fail %d %d\n", idx, raw->curlen);
--- /dev/null
+From 46c31e1604d121221167cb09380de8c7d53290b9 Mon Sep 17 00:00:00 2001
+From: Sergey Shtylyov <s.shtylyov@auroraos.dev>
+Date: Fri, 30 Jan 2026 23:35:42 +0300
+Subject: drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()
+
+From: Sergey Shtylyov <s.shtylyov@auroraos.dev>
+
+commit 46c31e1604d121221167cb09380de8c7d53290b9 upstream.
+
+The result of cdn_dp_reg_write() is checked everywhere (with the error
+being logged by the callers) except one place in cdn_dp_config_video().
+Add the missing result check, bailing out early on error...
+
+Found by Linux Verification Center (linuxtesting.org) with the Svace static
+analysis tool.
+
+Fixes: 1a0f7ed3abe2 ("drm/rockchip: cdn-dp: add cdn DP support for rk3399")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@auroraos.dev>
+Cc: stable@vger.kernel.org
+Reviewed-by: Chaoyi Chen <chaoyi.chen@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patch.msgid.link/adf6b313-f7db-4d8f-9000-8c65446ba041@auroraos.dev
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c
++++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
+@@ -683,6 +683,8 @@ int cdn_dp_config_video(struct cdn_dp_de
+ val = div_u64(8 * (symbol + 1), bit_per_pix) - val;
+ val += 2;
+ ret = cdn_dp_reg_write(dp, DP_VC_TABLE(15), val);
++ if (ret)
++ goto err_config_video;
+
+ switch (video->color_depth) {
+ case 6:
net-mlx5e-reject-unsupported-cb-shaper-tsa-in-ets-va.patch
net-ipv6-fix-dif-and-sdif-mismatch-in-raw6_icmp_erro.patch
bpf-sockmap-fix-cork-use-after-free-in-tcp_bpf_sendm.patch
+drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch
+drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch
+drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch
+drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
