github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/gud: fix out-of-bounds write in gud_plane_atomic_check()

Browse Source 
The plane property loop uses req->properties[num_properties + i] as write
index while simultaneously incrementing `num_properties` inside the loop.
At iteration i, num_properties has also incremented by i, so the write
is done at `initial_num_properties + 2*i`, skipping every other index and
advancing by 2 per iteration.

With just 2 connector and 32 plane properties the last write happens at
index 64, one slot past the end of the 64-slot (indices 0–63)
allocation. A USB device can trigger OOB by advertising the maximum
number of properties.

Fix by dropping the redundant `+ i`; num_properties is already the correct
running index, as gud_connector_fill_properties() fills the preceding
slots.

Fixes: 40e1a70b4a ("drm: Add GUD USB Display driver")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260821071812.16500-1-sajal2005gupta%40gmail.com?part=1
Signed-off-by: Sajal Gupta <sajal2005gupta@gmail.com>
Cc: <stable@vger.kernel.org>
Acked-by: Ruben Wauters <rubenru09@aol.com>
Signed-off-by: Ruben Wauters <rubenru09@aol.com>
Link: https://patch.msgid.link/20260902123254.36987-1-sajal2005gupta@gmail.com
This commit is contained in:
Sajal Gupta 2026-09-02 18:00:57 +05:30 committed by Ruben Wauters
parent effce1cb87
commit 59ced288fc
No known key found for this signature in database
GPG Key ID: D27E50C050AE0CE1
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/gpu/drm/gud/gud_pipe.c
View File

@ -565,8 +565,8 @@ int gud_plane_atomic_check(struct drm_plane *plane,
goto out;
}
req->properties[num_properties + i].prop = cpu_to_le16(prop);
req->properties[num_properties + i].val = cpu_to_le64(val);
req->properties[num_properties].prop = cpu_to_le16(prop);
req->properties[num_properties].val = cpu_to_le64(val);
num_properties++;
}