linux/drivers/gpu/drm
Tao Yu da1ea35fea
drm/gud: validate TV mode names before creating enum property
The GUD protocol returns TV mode names as fixed-size
GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be
NUL-terminated.

gud_connector_add_tv_mode() currently passes each fixed-size entry
directly to drm_mode_create_tv_properties_legacy(), which eventually
reaches drm_property_add_enum() and strlen(). If a device returns an
entry without a terminating NUL byte, strlen() reads past the end of
the slot and can run beyond the allocated buffer, triggering an
out-of-bounds read.

Validate that each returned TV mode name contains a NUL terminator
within its fixed-size slot before passing it to the DRM property code.
If a malformed entry is found, reject the device response with -EIO.

This fixes the out-of-bounds read without changing the handling of
valid devices, and avoids silently truncating malformed protocol data.

Reported-by: syzbot+9ae8e7884e451eaed5b4@syzkaller.appspotmail.com
Fixes: 40e1a70b4a ("drm: Add GUD USB Display driver")
Signed-off-by: Tao Yu <tao1.yu@intel.com>
Reviewed-by: Ruben Wauters <rubenru09@aol.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ruben Wauters <rubenru09@aol.com>
Link: https://patch.msgid.link/20260819072835.4074130-1-tao1.yu@intel.com
2026-08-23 17:20:00 +01:00
..
adp drm-misc-next for v7.2-rc1: 2026-05-08 14:16:04 +10:00
amd Revert "drm/sched: Remove FIFO and RR and simplify to a single run queue" 2026-08-11 17:34:10 +01:00
arm drm/arm/komeda: fix error handling for clk_prepare_enable() and callers 2026-06-30 15:26:54 +01:00
armada drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
aspeed Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ast drm-misc-next for v7.1-rc1: 2026-05-06 10:12:25 +10:00
atmel-hlcdc drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
bridge drm/bridge: ps8640: propagate AUX transfer register errors 2026-07-30 14:19:57 -07:00
ci Merge tag 'drm-msm-next-2026-05-30' of https://gitlab.freedesktop.org/drm/msm into drm-next 2026-06-04 06:41:22 +10:00
clients drm/log: Fix infinite loop when scale is too large for display 2026-08-13 15:49:40 +02:00
display drm/connector/hdmi: Fix out of bounds memory read 2026-08-10 11:38:57 +02:00
etnaviv Revert "drm/etnaviv: Remove drm_sched_init_args->num_rqs usage" 2026-08-11 17:34:04 +01:00
exynos Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
fsl-dcu drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
gma500 drm/gma500: return errors from Oaktrail HDMI I2C reads 2026-07-22 22:46:27 +02:00
gud drm/gud: validate TV mode names before creating enum property 2026-08-23 17:20:00 +01:00
hisilicon Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
hyperv drm-next for 7.2-rc1 2026-06-17 10:21:00 +01:00
i915 drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status 2026-07-30 16:10:01 -04:00
imagination Revert "drm/imagination: Remove drm_sched_init_args->num_rqs usage" 2026-08-11 17:34:04 +01:00
imx Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ingenic drm-misc-next for v7.2-rc1: 2026-05-08 14:16:04 +10:00
kmb drm-misc-next for v7.2-rc1: 2026-05-08 14:16:04 +10:00
lima Revert "drm/lima: Remove drm_sched_init_args->num_rqs usage" 2026-08-11 17:34:03 +01:00
logicvc drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
loongson Linux 7.1-rc5 2026-05-28 09:58:36 +02:00
mcde drm/mcde: dsi: convert to of_drm_find_and_get_bridge() 2026-02-23 10:10:34 +01:00
mediatek Mediatek DRM Fixes - 20260729 2026-07-31 14:09:35 +10:00
meson Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
mgag200 drm-misc-next for v7.2-rc1: 2026-05-08 14:16:04 +10:00
msm Revert "drm/msm: Remove drm_sched_init_args->num_rqs usage" 2026-08-11 17:34:03 +01:00
mxsfb Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
nouveau drm/nouveau: unsubscribe the channel-kill event before the fence context 2026-08-20 17:33:43 -04:00
nova rust/drm/gem: Use DeviceContext with GEM objects 2026-06-02 22:51:16 +02:00
omapdrm drm-misc-next for v7.2-rc1: 2026-05-08 14:16:04 +10:00
panel drm/panel: fix unmet dependency bug for DRM_PANEL_HIMAX_HX83121A 2026-07-22 16:17:48 +02:00
panfrost Revert "drm/panfrost: Remove drm_sched_init_args->num_rqs usage" 2026-08-11 17:34:02 +01:00
panthor Revert "drm/panthor: Remove drm_sched_init_args->num_rqs usage" 2026-08-11 17:34:02 +01:00
pl111 Linux 6.19-rc7 2026-01-28 12:44:28 +10:00
qxl Linux 7.1-rc5 2026-05-28 09:58:36 +02:00
radeon drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression 2026-08-06 14:33:39 -04:00
renesas Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
rockchip Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
scheduler drm/sched: Mark fair policy as experimental 2026-08-11 17:34:13 +01:00
sitronix drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
solomon drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
sprd Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
sti Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
stm Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
sun4i Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
sysfb drm fixes for 7.2-rc1 2026-06-26 17:03:48 -07:00
tegra soc/tegra: pmc: Fixes for v7.2 2026-07-10 14:40:52 +02:00
tests drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem 2026-07-23 11:48:43 +02:00
tidss drm-misc-next for v7.2-rc1: 2026-05-08 14:16:04 +10:00
tilcdc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
tiny drm/appletbdrm: Allocate request/response buffers in begin_fb_access 2026-07-17 17:15:49 +02:00
ttm drm/ttm/pool: back up at native page order 2026-07-17 09:09:27 -07:00
tve200 drm/tve200: Fix probe cleanup after register failure 2026-05-05 11:16:39 +02:00
tyr rust/drm/gem: Use DeviceContext with GEM objects 2026-06-02 22:51:16 +02:00
udl drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
v3d Revert "drm/v3d: Remove drm_sched_init_args->num_rqs usage" 2026-08-11 17:34:01 +01:00
vboxvideo drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
vc4 drm/vc4: Zero the tile state data array before each BIN job 2026-07-28 09:16:30 -03:00
verisilicon drm: verisilicon: fix build failure of cursor plane code 2026-05-26 16:05:53 +08:00
vgem Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
virtio drm/virtio: use the DMA API for resource backing on Xen 2026-08-14 16:38:21 +03:00
vkms drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
vmwgfx drm/vmwgfx: validate external BO copy bounds for both stride paths 2026-07-27 11:29:24 -04:00
xe Revert "drm/xe: Remove drm_sched_init_args->num_rqs usage" 2026-08-11 17:34:00 +01:00
xen Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
xlnx drm: zynqmp_dp: switch to of_drm_get_bridge_by_endpoint() 2026-05-19 10:57:26 +02:00
drm_atomic_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_atomic_state_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_atomic_uapi.c drm-next for 7.2-rc1 2026-06-17 10:21:00 +01:00
drm_atomic.c drm-next for 7.2-rc1 2026-06-17 10:21:00 +01:00
drm_auth.c drm/auth: Only drm_drop_master if it exists 2026-04-21 22:05:51 +08:00
drm_blend.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_bridge_helper.c
drm_bridge.c drm/bridge: add of_drm_get_bridge_by_endpoint() 2026-05-19 10:57:25 +02:00
drm_buddy.c drm/buddy: Integrate lockdep annotations for gpu buddy manager 2026-05-08 19:16:19 +05:30
drm_cache.c
drm_client_event.c
drm_client_modeset.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_client_sysrq.c
drm_client.c drm/client: Export drm_client_buffer_create() 2026-03-03 09:28:31 +01:00
drm_color_mgmt.c mm.git review status for mm-hotfixes-stable..mm-nonmm-stable 2026-06-21 13:20:19 -07:00
drm_colorop.c drm-next for 7.2-rc1 2026-06-17 10:21:00 +01:00
drm_connector.c drm fixes for 7.2-rc1 2026-06-26 17:03:48 -07:00
drm_crtc_helper_internal.h
drm_crtc_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_crtc_internal.h drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_crtc.c drm/simple-kms: Deprecate simple-kms helpers 2026-03-25 15:05:22 +01:00
drm_damage_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_debugfs_crc.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
drm_debugfs.c drm/debug: don't register files for unsupported HDMI InfoFrames 2026-01-19 13:11:47 +02:00
drm_displayid_internal.h drm/displayid: fix Tiled Display Topology ID size 2026-06-15 13:50:42 +03:00
drm_displayid.c
drm_draw_internal.h
drm_draw.c
drm_drv.c drm/gem: Make the GEM LRU lock part of drm_device 2026-05-18 15:16:47 +02:00
drm_dumb_buffers.c drm/dumb-buffer: Drop buffer-size limits for now 2026-06-03 18:47:51 +02:00
drm_edid_load.c
drm_edid.c drm/edid: fix OOB read in drm_parse_tiled_block() 2026-06-22 11:13:27 +03:00
drm_eld.c
drm_encoder.c drm/encoder: drm_encoder_cleanup: lock the encoder chain mutex during removal 2026-04-16 09:08:42 +02:00
drm_exec.c drm/exec, drm/xe: Avoid abusing the drm_exec retry pointer 2026-05-25 10:45:38 +02:00
drm_fb_dma_helper.c
drm_fb_helper.c drm/fb-helper: Only consider active CRTCs for vblank sync 2026-07-09 09:23:31 +02:00
drm_fbdev_dma.c
drm_fbdev_shmem.c
drm_fbdev_ttm.c
drm_file.c Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug" 2026-03-26 14:09:26 +01:00
drm_flip_work.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
drm_format_helper.c
drm_format_internal.h
drm_fourcc.c drm/fourcc: Add DRM_FORMAT_XVUY2101010 2026-05-05 14:04:29 +03:00
drm_framebuffer.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_gem_atomic_helper.c drm/simple-kms: Deprecate simple-kms helpers 2026-03-25 15:05:22 +01:00
drm_gem_dma_helper.c drm/gem-dma: set VM_DONTDUMP for mmap 2026-03-26 14:35:18 +08:00
drm_gem_framebuffer_helper.c drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() 2026-04-27 11:27:22 +02:00
drm_gem_shmem_helper.c drm/shmem_helper: Check VMA boundaries for PMD mappings 2026-08-04 15:51:25 +02:00
drm_gem_ttm_helper.c
drm_gem_vram_helper.c drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs 2026-04-09 09:34:28 +02:00
drm_gem.c drm-next for 7.2-rc1 2026-06-17 10:21:00 +01:00
drm_gpusvm.c drm/gpusvm: Zero HMM PFNs before scanning ranges 2026-07-21 00:27:34 -07:00
drm_gpuvm.c DRM Rust changes for v7.2-rc1 2026-06-05 09:13:12 +10:00
drm_internal.h
drm_ioc32.c drm/ioc32: stop speculation on the drm_compat_ioctl path 2026-04-02 08:24:55 +02:00
drm_ioctl.c drm: Guard DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE 2026-07-07 14:57:10 +02:00
drm_kms_helper_common.c
drm_lease.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
drm_managed.c drm/managed: use special gfp_t format specifier 2026-05-28 21:04:52 -07:00
drm_mipi_dbi.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_mipi_dsi.c drm/mipi-dsi: add mipi_dsi_shutdown_peripheral_multi 2026-04-24 10:12:16 -07:00
drm_mm.c
drm_mode_config.c Linux 7.0-rc7 2026-04-07 12:36:31 +02:00
drm_mode_object.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_modes.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
drm_modeset_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_modeset_lock.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
drm_of.c drm: of: forbid bridge-only calls to drm_of_find_panel_or_bridge() 2026-05-19 10:57:26 +02:00
drm_pagemap_util.c drm/pagemap_util: Ensure proper cache lock management on free 2026-03-17 15:39:07 +01:00
drm_pagemap.c Revert "drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION" 2026-07-24 08:02:14 +02:00
drm_panel_backlight_quirks.c drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05 2026-07-17 17:41:15 -04:00
drm_panel_orientation_quirks.c
drm_panel.c drm/panel: fix kernel-doc warning for devm_drm_panel_add() 2026-05-26 16:00:32 +02:00
drm_panic_qr.rs
drm_panic.c
drm_pci.c
drm_plane_helper.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
drm_plane.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
drm_prime.c drm/prime: Limit scatter list size with dedicated DMA device 2026-03-23 13:23:29 +08:00
drm_print.c
drm_privacy_screen_x86.c
drm_privacy_screen.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
drm_probe_helper.c drm/probe-helper: replace use of system_wq with system_percpu_wq 2026-02-09 09:41:09 +01:00
drm_property.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
drm_ras_genl_family.c drm/ras: Introduce the DRM RAS infrastructure over generic netlink 2026-03-05 19:38:55 -05:00
drm_ras_nl.c drm/drm_ras: Add clear-error-counter netlink command to drm_ras 2026-04-24 08:43:42 -04:00
drm_ras_nl.h drm/drm_ras: Add clear-error-counter netlink command to drm_ras 2026-04-24 08:43:42 -04:00
drm_ras.c drm/drm_ras: Add clear-error-counter netlink command to drm_ras 2026-04-24 08:43:42 -04:00
drm_rect.c
drm_self_refresh_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_simple_kms_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_suballoc.c Merge tag 'drm-xe-next-2026-03-02' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next 2026-03-03 10:37:29 +10:00
drm_syncobj.c drm/syncobj: Fix memory leak in drm_syncobj_find_fence() 2026-05-18 11:19:59 +01:00
drm_sysfs.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
drm_trace_points.c
drm_trace.h
drm_vblank_helper.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
drm_vblank_work.c
drm_vblank.c drm/vblank: Extract get_vblank_counter_and_timestamp() 2026-03-27 13:40:44 +02:00
drm_vma_manager.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
drm_writeback.c dma-buf: inline spinlock for fence protection v5 2026-02-23 16:14:19 +01:00
Kconfig drm/gpuvm: rust: add RUST_DRM_GPUVM option to Kconfig 2026-05-05 12:59:41 +02:00
Kconfig.debug drm: fix dead default for DRM_TTM_KUNIT_TEST 2026-03-24 16:19:04 +01:00
Makefile Merge drm/drm-next into drm-xe-next 2026-03-12 07:23:23 -07:00