In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amd\/display: Fix out-of-bounds stream encoder index v3<\/p>\n
eng_id can be negative and that stream_enc_regs[]
\ncan be indexed out of bounds.<\/p>\n
eng_id is used directly as an index into stream_enc_regs[], which has
\nonly 5 entries. When eng_id is 5 (ENGINE_ID_DIGF) or negative, this can
\naccess memory past the end of the array.<\/p>\n
Add a bounds check using ARRAY_SIZE() before using eng_id as an index.
\nThe unsigned cast also rejects negative values.<\/p>\n
This avoids out-of-bounds access.<\/p>\n
Fixes the below smatch error:
\ndcn*_resource.c: stream_encoder_create() may index
\nstream_enc_regs[eng_id] out of bounds (size 5).<\/p>\n
drivers\/gpu\/drm\/amd\/amdgpu\/..\/display\/dc\/resource\/dcn351\/dcn351_resource.c
\n 1246 static struct stream_encoder *dcn35_stream_encoder_create(
\n 1247 enum engine_id eng_id,
\n 1248 struct dc_context *ctx)
\n 1249 {<\/p>\n
…<\/p>\n
1255
\n 1256 \/* Mapping of VPG, AFMT, DME register blocks to DIO block instance *\/
\n 1257 if (eng_id <= ENGINE_ID_DIGF) {<\/p>\n
ENGINE_ID_DIGF is 5. should <= be dc_bios,
\n 1283 eng_id, vpg, afmt,
\n–> 1284 &stream_enc_regs[eng_id],
\n ^^^^^^^^^^^^^^^^^^^^^^^ This stream_enc_regs[] array has 5 elements so we are one element beyond the end of the array.<\/p>\n
…<\/p>\n
1287 return &enc1->base;
\n 1288 }<\/p>\n
v2: use explicit bounds check as suggested by Roman\/Dan; avoid unsigned int cast<\/p>\n
v3: The compiler already knows how to compare the two values, so the
\n cast (int) is not needed. (Roman)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amd\/display: Fix out-of-bounds stream encoder index v3<\/p>\n
eng_id can be negative and that stream_enc_regs[]
\ncan be indexed out of<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15472","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15472","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15472"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15472"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15472"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}