niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

drm/amd/display: fix possible buffer overflow relating to secure display

Browse source 
It is possible that adev->dm.dc->caps.max_links is greater than
AMDGPU_MAX_CRTCS. So, to not potentially access unallocated memory use
adev->mode_info.num_crtc to do the bounds check instead of
adev->dm.dc->caps.max_links.

Fixes: 1b11ff764a ("drm/amd/display: Implement multiple secure display")
Fixes: b8ff7e08ba ("drm/amd/display: Fix when disabling secure_display")
Reviewed-by: Alan Liu <HaoPing.Liu@amd.com>
Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Hamza Mahfooz 2023-01-11 12:25:14 -05:00 • committed by Alex Deucher
parent 0c2dece8fb
commit c3d7496094
2 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
View file

@ -1741,7 +1741,7 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev)
#if defined(CONFIG_DRM_AMD_SECURE_DISPLAY) #if defined(CONFIG_DRM_AMD_SECURE_DISPLAY)
if (adev->dm.secure_display_ctxs) { if (adev->dm.secure_display_ctxs) {
for (i = 0; i < adev->dm.dc->caps.max_links; i++) { for (i = 0; i < adev->mode_info.num_crtc; i++) {
if (adev->dm.secure_display_ctxs[i].crtc) { if (adev->dm.secure_display_ctxs[i].crtc) {
flush_work(&adev->dm.secure_display_ctxs[i].notify_ta_work); flush_work(&adev->dm.secure_display_ctxs[i].notify_ta_work);
flush_work(&adev->dm.secure_display_ctxs[i].forward_roi_work); flush_work(&adev->dm.secure_display_ctxs[i].forward_roi_work);

8
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
View file

@ -223,7 +223,7 @@ int amdgpu_dm_crtc_configure_crc_source(struct drm_crtc *crtc,
#if defined(CONFIG_DRM_AMD_SECURE_DISPLAY) #if defined(CONFIG_DRM_AMD_SECURE_DISPLAY)
/* Disable secure_display if it was enabled */ /* Disable secure_display if it was enabled */
if (!enable) { if (!enable) {
for (i = 0; i < adev->dm.dc->caps.max_links; i++) { for (i = 0; i < adev->mode_info.num_crtc; i++) {
if (adev->dm.secure_display_ctxs[i].crtc == crtc) { if (adev->dm.secure_display_ctxs[i].crtc == crtc) {
/* stop ROI update on this crtc */ /* stop ROI update on this crtc */
flush_work(&adev->dm.secure_display_ctxs[i].notify_ta_work); flush_work(&adev->dm.secure_display_ctxs[i].notify_ta_work);
@ -544,12 +544,14 @@ amdgpu_dm_crtc_secure_display_create_contexts(struct amdgpu_device *adev)
struct secure_display_context *secure_display_ctxs = NULL; struct secure_display_context *secure_display_ctxs = NULL;
int i; int i;
secure_display_ctxs = kcalloc(AMDGPU_MAX_CRTCS, sizeof(struct secure_display_context), GFP_KERNEL); secure_display_ctxs = kcalloc(adev->mode_info.num_crtc,
sizeof(struct secure_display_context),
GFP_KERNEL);
if (!secure_display_ctxs) if (!secure_display_ctxs)
return NULL; return NULL;
for (i = 0; i < adev->dm.dc->caps.max_links; i++) { for (i = 0; i < adev->mode_info.num_crtc; i++) {
INIT_WORK(&secure_display_ctxs[i].forward_roi_work, amdgpu_dm_forward_crc_window); INIT_WORK(&secure_display_ctxs[i].forward_roi_work, amdgpu_dm_forward_crc_window);
INIT_WORK(&secure_display_ctxs[i].notify_ta_work, amdgpu_dm_crtc_notify_ta_to_read); INIT_WORK(&secure_display_ctxs[i].notify_ta_work, amdgpu_dm_crtc_notify_ta_to_read);
secure_display_ctxs[i].crtc = &adev->mode_info.crtcs[i]->base; secure_display_ctxs[i].crtc = &adev->mode_info.crtcs[i]->base;