From 5bacecc3c56131c31f18b23d366f2184328fd9cf Mon Sep 17 00:00:00 2001

From: Jani Nikula <jani.nikula@intel.com>

Date: Thu, 16 Feb 2023 22:44:58 +0200

Subject: [PATCH] drm/displayid: add displayid_get_header() and check bounds better

Git-commit: 5bacecc3c56131c31f18b23d366f2184328fd9cf

Patch-mainline: v6.4-rc1

References: git-fixes

Add a helper to get a pointer to struct displayid_header. To be

pedantic, add buffer overflow checks to not touch the base if that

itself would overflow.

Cc: Iaroslav Boliukin <iam@lach.pw>

Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com>

Signed-off-by: Jani Nikula <jani.nikula@intel.com>

Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>

Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>

Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>

Link: https://patchwork.freedesktop.org/patch/msgid/4a03b3a5132642d3cdb6d4c2641422955a917292.1676580180.git.jani.nikula@intel.com

Acked-by: Takashi Iwai <tiwai@suse.de>

---

 drivers/gpu/drm/drm_displayid.c | 17 ++++++++++++++++-

 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_displayid.c b/drivers/gpu/drm/drm_displayid.c

index 38ea8203df45..7d03159dc146 100644

--- a/drivers/gpu/drm/drm_displayid.c

+++ b/drivers/gpu/drm/drm_displayid.c

@@ -7,13 +7,28 @@

 #include <drm/drm_edid.h>

 #include <drm/drm_print.h>

+static const struct displayid_header *

+displayid_get_header(const u8 *displayid, int length, int index)

+{

+	const struct displayid_header *base;

+

+	if (sizeof(*base) > length - index)

+		return ERR_PTR(-EINVAL);

+

+	base = (const struct displayid_header *)&displayid[index];

+

+	return base;

+}

+

 static int validate_displayid(const u8 *displayid, int length, int idx)

 {

 	int i, dispid_length;

 	u8 csum = 0;

 	const struct displayid_header *base;

-	base = (const struct displayid_header *)&displayid[idx];

+	base = displayid_get_header(displayid, length, idx);

+	if (IS_ERR(base))

+		return PTR_ERR(base);

 	DRM_DEBUG_KMS("base revision 0x%x, length %d, %d %d\n",

 		      base->rev, base->bytes, base->prod_id, base->ext_count);

-- 

2.35.3