Harry Wentland f0f3981c43 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size ... [Why & How] During HDCP 2.x repeater authentication over HDMI, the driver reads the sink's RxStatus register and extracts a 10-bit message size field (max value 1023). This value is used as the read length for the ReceiverID list without being clamped to the size of the destination buffer rx_id_list[177]. A malicious HDMI repeater could advertise a message size larger than the buffer, causing an out-of-bounds write during the I2C read. Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the rx_id_list buffer, matching the approach already used in the DP branch. Fixes: eff682f83c ("drm/amd/display: Add DDC handles for HDCP2.2") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 229212219e) Cc: stable@vger.kernel.org		2026-06-03 14:45:23 -04:00
..
color	drm/amd/display: Fix Silence warnings	2026-03-23 14:15:31 -04:00
freesync	drm/amd/display: Fix implicit narrowing conversions in modules	2026-04-17 15:21:29 -04:00
hdcp	drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size	2026-06-03 14:45:23 -04:00
inc	drm/amd/display: Revise VSC SDP header for Panel Replay	2025-12-08 13:56:36 -05:00
info_packet	drm/amd/display: Revise VSC SDP header for Panel Replay	2025-12-08 13:56:36 -05:00
power	drm/amd/display: Fix implicit narrowing conversions in modules	2026-04-17 15:21:29 -04:00
vmid	drm/amd/display: Fix implicit narrowing conversions in modules	2026-04-17 15:21:29 -04:00