Sajal Gupta 59ced288fc drm/gud: fix out-of-bounds write in gud_plane_atomic_check() ... The plane property loop uses req->properties[num_properties + i] as write index while simultaneously incrementing `num_properties` inside the loop. At iteration i, num_properties has also incremented by i, so the write is done at `initial_num_properties + 2*i`, skipping every other index and advancing by 2 per iteration. With just 2 connector and 32 plane properties the last write happens at index 64, one slot past the end of the 64-slot (indices 0–63) allocation. A USB device can trigger OOB by advertising the maximum number of properties. Fix by dropping the redundant `+ i`; num_properties is already the correct running index, as gud_connector_fill_properties() fills the preceding slots. Fixes: 40e1a70b4a ("drm: Add GUD USB Display driver") Reported-by: Sashiko <sashiko-bot@kernel.org> Link: https://sashiko.dev/#/patchset/20260821071812.16500-1-sajal2005gupta%40gmail.com?part=1 Signed-off-by: Sajal Gupta <sajal2005gupta@gmail.com> Cc: <stable@vger.kernel.org> Acked-by: Ruben Wauters <rubenru09@aol.com> Signed-off-by: Ruben Wauters <rubenru09@aol.com> Link: https://patch.msgid.link/20260902123254.36987-1-sajal2005gupta@gmail.com		2026-09-12 13:56:44 +01:00
..
gud_connector.c	drm/gud: validate TV mode names before creating enum property	2026-08-23 17:20:00 +01:00
gud_drv.c	drm/gud: validate GUD_ROTATION_0 is present in supported rotations	2026-08-23 17:35:13 +01:00
gud_internal.h	drm: Rename struct drm_atomic_state to drm_atomic_commit	2026-05-04 14:05:04 +10:00
gud_pipe.c	drm/gud: fix out-of-bounds write in gud_plane_atomic_check()	2026-09-12 13:56:44 +01:00
Kconfig	drm/gud: Run DRM default client setup	2024-09-26 09:31:28 +02:00
Makefile