From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f179.google.com (mail-pf1-f179.google.com [209.85.210.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 05CA4394797 for ; Wed, 1 Jul 2026 06:44:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782888289; cv=none; b=lnodkdAC7/RGg157lht1FcqhKETCdBFfw4l9cN+/uNaZfIGxLEHOhYTmIJKHpc4bxH8i50iyKNk6XmpPFiUpHwTOZQsosEGGX6BC3p4er/S8CPfln64aAtNDED9hj8CAGRlBY9C+dtQxsJWV1P2cp9z4lunSbs/0vHetI0Q6630= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782888289; c=relaxed/simple; bh=sbjNVpz//fss1DULWzGx4peqqFuWrgDRRMFCTd/Lcq4=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=cL9Dfykb+3ZpyAtBAtnMndb+yQiBcZ77Kv+MYGQ1M5lLydqAlJBZdxPpLrYUQ6/vlY3yIyuxqAKOnKc6x29ukFNRV210VF+t5Nr725kDTlIoGby50Ek5gRnSvRl3X6zaj3ccAK8yGq+/V7eVANFjOVNbIputorgQnOj/jMcwJ7o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=gTVJUSIw; arc=none smtp.client-ip=209.85.210.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="gTVJUSIw" Received: by mail-pf1-f179.google.com with SMTP id d2e1a72fcca58-8478cc93299so148814b3a.2 for ; Tue, 30 Jun 2026 23:44:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782888287; x=1783493087; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Zr+rNtK43qtc1F/vQgzrjcPmk3IPAkJ24rsdBVmNakY=; b=gTVJUSIw0IfUVncPv2wlBqYXmRhloAVHfP7GGjNGFOlYkvhHJwGygwoem/U42jOPt4 05QLHtNwVIA4mcQu21YjvFMlpd/4eob9tz+k9ahEMcKEOCXlvXO1M5KF817mfMUxmjaD 88OWIgNjsXup3O4Iq7We0pqaFrCz5Fm7BnwjMNrqBoeNvylQPnDTjOD3tUobAq2w4rep XirzHKIAl497NDNIszlV2YU7lXGCSU3dcIydBTPyp4EbZYnle2HWAK7vbJbkX3i/tl8/ QoCGAPenqH4CLFzFi/2sX5YUv0tOS/vH50QarJRhATFy5QyhuwZj7sw5djUwvUeFJQ04 zZmg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782888287; x=1783493087; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Zr+rNtK43qtc1F/vQgzrjcPmk3IPAkJ24rsdBVmNakY=; b=ImyOPzB/0MBElwbYFCenBjS+gw3LPmZVuRwGSJNcrxjsy3EAo32Y7G6RMeH0Eva4Xd MNiVR1snASegOETn7F6NUMRwzVRUH+u1cMBNxqn3Q2WNwGrhXrBHAkwSAfa9WIht5En9 8oSF2Pdxiz/gQMNSx48TxX3Lb5OhHFFscLMmst0C0oATHNRlVNxvSXyMg3DQKAY1bueV C7Bt7qKpZlRPjbvS5Er439f8Tv8gJ7kkGufLf50h+EdxQ85sQ6pQ//uudJfJuoegKYS6 qr5uOs9bS+AY5Nb8JY2cca7EEwvPNSXTP8fNGnqETj/628w3STuBkxKK4NRHlMvu9ZAV KOhw== X-Forwarded-Encrypted: i=1; AHgh+RozhI2o8DZix7/pX1z3Wk0YTK8JG2F92QaytVtwdsyLyXZjzCDviQ3XK9A0L8tQR3cPuiVD9HpfnALHeTE=@vger.kernel.org X-Gm-Message-State: AOJu0YxfRbH7DNu9VJN1vo2xnKkp4QX4nIJZWgHIPKWm29ptFGCVJzP4 xnFuvc0Cktkncynepdkv8sBMjbkXnuL+8GoL2cyUZX5pkiHHoHFfePmqEtnBaw== X-Gm-Gg: AfdE7ckuVdRJ3NKq3pQTIZj4SiwlmpBMqrwjBwg/jOFh4DkvCQ8OLeiTzGzhvMbnFbu 0ubxFze926eNPnmzKol4qAznfaULBsZcVINqBuTAxYLayn3PGYRvDLKY9zQfgaVIN6a8OJ1Lqzl WlEAXiKc+BBTrgaQDdJ1xfnTgxQwOIWBS1+4EYgD3uhw7LByTB3VF48YOtbVbe+8mHGCdUpd7hZ 6UdFiv4pMEtvn+dQ3CtL0EK+8O2aZg7XXzMV5zrzArLw670DcvgXhC+kEmV1wE874LyHwMl6exA JvkjVztqhhpxOols2oYec+yThFjnNDrZkjnMwLNC18H900n6HeCcJe4jkbHtk/PB4y5WeZ9ADYW 9KzQKnyIdx8uveF5+Fw8THp4ElVaRJTtm5MT8/TqnUqQ5qyOZcXDrfzSW0l2ZhH4B4ykoyCojNn ATPMZ+Fh2fUWaWo0oi7PP/IySy73snKzYJ3s8cEgjtsMJ2dfE4 X-Received: by 2002:a05:6a00:1302:b0:847:9565:7a58 with SMTP id d2e1a72fcca58-847c0948eb1mr253384b3a.48.1782888286685; Tue, 30 Jun 2026 23:44:46 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-847a033a7aesm3381170b3a.46.2026.06.30.23.44.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 30 Jun 2026 23:44:46 -0700 (PDT) From: Maoyi Xie To: Andrzej Hajda , Neil Armstrong , Robert Foss Cc: Kaixuan Li , Laurent Pinchart , Jonas Karlman , Jernej Skrabec , Douglas Anderson , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: [PATCH] drm/bridge: tc358767: clamp the reported AUX read size to the request Date: Wed, 1 Jul 2026 14:44:40 +0800 Message-Id: <20260701064440.1541418-1-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit tc_aux_transfer() clamps an AUX read to the payload limit: size_t size = min_t(size_t, DP_AUX_MAX_PAYLOAD_BYTES - 1, msg->size); After the transfer it replaces size with the byte count the controller reports in AUX_BYTES: if (size) size = FIELD_GET(AUX_BYTES, auxstatus); AUX_BYTES is GENMASK(15, 8), so it can be up to 255. Nothing clamps it back to the request. tc_aux_read_data() reads that many bytes into the 16-byte auxrdata stack buffer, then copies them into the caller buffer. A reported count of 255 makes the read run to 256 bytes and overruns both. The controller should never report more than it was asked to transfer, so this is defense in depth rather than a live hole. The reported count is only lightly trusted, and the check is cheap. Clamp it back to the request, the same way ti-sn65dsi86 does in commit aca58eac52b8 ("drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in AUX xfer"). Fixes: 12dfe7c4d9c5 ("drm/bridge: tc358767: Use reported AUX transfer size") Co-developed-by: Kaixuan Li Signed-off-by: Kaixuan Li Signed-off-by: Maoyi Xie --- drivers/gpu/drm/bridge/tc358767.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c index 4097fef4b8..26ba5a6c1b 100644 --- a/drivers/gpu/drm/bridge/tc358767.c +++ b/drivers/gpu/drm/bridge/tc358767.c @@ -527,7 +527,7 @@ static ssize_t tc_aux_transfer(struct drm_dp_aux *aux, * address-only transfer */ if (size) - size = FIELD_GET(AUX_BYTES, auxstatus); + size = min_t(size_t, size, FIELD_GET(AUX_BYTES, auxstatus)); msg->reply = FIELD_GET(AUX_STATUS, auxstatus); switch (request) { -- 2.34.1