openbsd/src
1
0
Fork 0
mirror of https://github.com/openbsd/src.git synced 2026-06-17 23:03:29 +02:00
Code Activity

drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

Browse Source 
From Harry Wentland
1ecde19bfce6535bffddad1139ff466b6d401b8e in linux-6.18.y/6.18.34
6c92f6d9600efa3ef0d9e560a2b52776d9803c29 in mainline linux
This commit is contained in:
jsg
2026-06-02 03:48:34 +00:00
parent 483483a0eb
commit 98fac70f84
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sys/dev/pci/drm/amd/display/dc/core/dc.c
+5 -1
View File
@@ -5884,7 +5884,11 @@ bool dc_process_dmub_aux_transfer_async(struct dc *dc,
uint8_t action;
union dmub_rb_cmd cmd = {0};
ASSERT(payload->length <= 16);
if (link_index >= dc->link_count || !dc->links[link_index])
return false;
if (payload->length > sizeof(cmd.dp_aux_access.aux_control.dpaux.data))
return false;
cmd.dp_aux_access.header.type = DMUB_CMD__DP_AUX_ACCESS;
cmd.dp_aux_access.header.payload_bytes = 0;