From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A0CBC47CC80 for ; Thu, 7 May 2026 19:22:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778181731; cv=none; b=oY0rh7PDcT9GtL6grFowyj2c8lEc5crljjxFgJdp4U0vrOTd9RpEdpaYZthIwH+Ee4y4ZxvUJHl+d48wMA+2eTUbzFwKRYRCessZ/WIlv/v72Q9OC9/XNBj0/aIJtSpWQc8T5QttekMgT3KVt/oVwH6m2QSMjOLEr9DbwyWHMLM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778181731; c=relaxed/simple; bh=6F/SsrqqdC5cyKhn0Po0bbndZPk6VxbHEfLgcjQfOC0=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=h4VZg9iEVqeY1Gq/uhshAQIl9/THvY8D+cRPBAS50d/Z0Yd7lRjKIQiOoNActL7Dnepl/ELMmh1WLu6dFTph1+Y3D6Fpwuq79JhRqmk6IurxvSfdHew9h7ZH+xG3WDrpmDifQcNsapNHRk6UeryQ5NboNN0p8OIAeoRDnPGg0kU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=OBPgtPqm; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=WP2eoejq; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="OBPgtPqm"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="WP2eoejq" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778181728; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=h4Z240fQp2pA+4pbLjOL0fSakiiKJZNOCixmjOSCA0s=; b=OBPgtPqmmOUHE2SAEs3lvvNSnT/3P3Nwkn4DH7tlVBlCL2Tn3WzuWyDYR/ksV0Cy/ycvZe FqlFHjbHl1gRskwnhcXs8U7NoeHPBJxi/0CPMvNIrmT2a/JIRGM/oTYwOgHb7tvk37y9rL 0WEc7vapAJWQc0Fe43rvZeyTJqfS/rg= Received: from mail-qt1-f200.google.com (mail-qt1-f200.google.com [209.85.160.200]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-327-U1P6GU3GOGyl9BxmOoTU-w-1; Thu, 07 May 2026 15:22:07 -0400 X-MC-Unique: U1P6GU3GOGyl9BxmOoTU-w-1 X-Mimecast-MFC-AGG-ID: U1P6GU3GOGyl9BxmOoTU-w_1778181727 Received: by mail-qt1-f200.google.com with SMTP id d75a77b69052e-50fbc70cfbdso29317421cf.2 for ; Thu, 07 May 2026 12:22:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1778181726; x=1778786526; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:from:to:cc:subject :date:message-id:reply-to; bh=h4Z240fQp2pA+4pbLjOL0fSakiiKJZNOCixmjOSCA0s=; b=WP2eoejqv3IuEV/yAwUtG8As268NirzRyA5tDmNZO/yNGxC3N1qlVqoT0z6lm/E7h9 GZEIOjAS+cPEFGJkND3P8v0bq8F+0SwfJrGQg7vvn+aGtHAefOwh3h3TaebDCT/7mn/x j3/7pv6TyiMRtg9mdQfRupTn6HDC9/PDqkxINBAq8st3ytDgjpw5N148JPQQs5Yhqsif zWiK5xfeDclQwVq/sbW6o/y64sTOcgv56HqlJJCOyox1tsGgeS/KkqfrWN93b01oSzG1 VV0rFwNS0p3258ISnOHVScPBcQOluO4OfUjaepf3JbWDcbrU9JmXbtBRC5Jw8lIncGv4 XQWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778181726; x=1778786526; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=h4Z240fQp2pA+4pbLjOL0fSakiiKJZNOCixmjOSCA0s=; b=MuBxKmwjMJFnFBwO3K988mSVKm6ZChC0WW0VK5+e+eGS5nmVckomDAE0vAdxP49k8O pK+JsU5YP+gwvDvkl0hnLmHb45orl9OK86EGUFfuFh9aGeMuX2yLzJtqjOO8Im+r9SnB ULwf9sEZphsy4egIm1cUfFFRkX3gKlRE+bKd0t1WNh0tImcV7t9GVK7qQ2TauL+Ookpg zgHNtVv3LNxfpOyz7/4Vu488S9wzsAF+D5AKlBi1Iq8wMF4Qwu1nG6TxAT3JC+mQVsLV Qvvo+EYOEfFTM4wvh31zYcdd1PEZ4toSSf2R8cATpD79/tCLGj5z8S8yKLGKqRy2FqNC X2cA== X-Forwarded-Encrypted: i=1; AFNElJ/4MD/IYxQC/iRRVifsJnKJFKYhdMvrYfv/40YQFys+HFO9L4oPB89FRBOdCglO8T8aUvHVg6iTVDgnoP0=@vger.kernel.org X-Gm-Message-State: AOJu0YyfsWfXBn1ER4GZbfFYZInsW0gAf3gf1x8NU58+m48ewRQgBelu hcPM4CRzP7yHsWuRMmD2fDhria1yYGqgi2TOSn8fo1gEVx73o0c6p17HnYKFiOLCVVSYFsBS27c foxBgpH+X7MSWzhBR96VypfreUsZtgqdg9PItlULzKb70FqSi/nvN7d87b9hBLGZ5Zg== X-Gm-Gg: AeBDieveha113+bMLEcIpywj/iI50bSWPWFp9yohW+rj7CiE56S7ebzoq+74LNdBBbm iQgu2Re2nEKhZgTu/GvNbprcXSz1zxsvgE5FbqdfRhrOa9n+Smxjm7ZhKGDFQYML1a8xaJwGenD UADS7VMp0v7THbPWdXvmUyFV2R7L5UGBbLVCp6NkpWBKD92Ga6mu3D/METjjvDdk+wAMQ6rE13+ dUZNGJGPa3oeFhmoUVAGPZCwwxG+pm7pjzDkXaE8GIUxh+s/TbiDpAIxnhA150RAv90umxllI+X akH6BN8f8CLQvuaMEW0vyma++OJ52u1mGdMDz5vdQLTWUjv/8/01NnPViMahNKu4WE75EQXcH2O j7EthygmZ2HO8WyppPw== X-Received: by 2002:a05:622a:1f8a:b0:50f:ccdd:13f1 with SMTP id d75a77b69052e-51461c26254mr144206801cf.16.1778181726617; Thu, 07 May 2026 12:22:06 -0700 (PDT) X-Received: by 2002:a05:622a:1f8a:b0:50f:ccdd:13f1 with SMTP id d75a77b69052e-51461c26254mr144206201cf.16.1778181726201; Thu, 07 May 2026 12:22:06 -0700 (PDT) Received: from [192.168.8.4] ([100.0.180.93]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-514850d0d82sm5922791cf.5.2026.05.07.12.22.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 07 May 2026 12:22:05 -0700 (PDT) Message-ID: <3af593e5ff0c3afa7e9e10b06ed9b6c9ab9edad2.camel@redhat.com> Subject: Re: [PATCH] drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers From: lyude@redhat.com To: Ashutosh Desai , dri-devel@lists.freedesktop.org Cc: maarten.lankhorst@linux.intel.com, mripard@kernel.org, tzimmermann@suse.de, airlied@gmail.com, simona@ffwll.ch, linux-kernel@vger.kernel.org Date: Thu, 07 May 2026 15:22:04 -0400 In-Reply-To: <20260410040026.2436280-1-ashutoshdesai993@gmail.com> References: <20260410040026.2436280-1-ashutoshdesai993@gmail.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.58.3 (3.58.3-1.fc43) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Comments down below On Fri, 2026-04-10 at 04:00 +0000, Ashutosh Desai wrote: > Three sideband reply parsers read 16-bit fields as: >=20 > =C2=A0 val =3D (raw->msg[idx] << 8) | (raw->msg[idx+1]); >=20 > and only check bounds after the fact (idx +=3D 2, then > if (idx > raw->curlen)).=C2=A0 When idx =3D=3D raw->curlen at the > point of the read, raw->msg[idx+1] is one byte past the > received message data, reading into the following struct > fields (curchunk_len, curchunk_idx, curlen). >=20 > Affected functions: > =C2=A0- drm_dp_sideband_parse_enum_path_resources_ack() > =C2=A0=C2=A0 full_payload_bw_number and avail_payload_bw_number fields > =C2=A0- drm_dp_sideband_parse_allocate_payload_ack() > =C2=A0=C2=A0 allocated_pbn field > =C2=A0- drm_dp_sideband_parse_query_payload_ack() > =C2=A0=C2=A0 allocated_pbn field >=20 > Move the bounds check to immediately before each 2-byte read, > using idx + 2 > raw->curlen, consistent with the fix pattern > used elsewhere in this file. >=20 > Signed-off-by: Ashutosh Desai > --- > =C2=A0drivers/gpu/drm/display/drm_dp_mst_topology.c | 17 +++++++---------= - > =C2=A01 file changed, 7 insertions(+), 10 deletions(-) >=20 > diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c > b/drivers/gpu/drm/display/drm_dp_mst_topology.c > index 9cef6c576..f2a7dbc5e 100644 > --- a/drivers/gpu/drm/display/drm_dp_mst_topology.c > +++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c > @@ -931,14 +931,13 @@ static bool > drm_dp_sideband_parse_enum_path_resources_ack(struct drm_dp_sideband > =C2=A0 idx++; > =C2=A0 if (idx > raw->curlen) > =C2=A0 goto fail_len; > + if (idx + 2 > raw->curlen) > + goto fail_len; Same feedback as the other patch - we can just remove the idx check above and replace it with the idx + 2 > raw->curlen check. > =C2=A0 repmsg->u.path_resources.full_payload_bw_number =3D (raw- > >msg[idx] << 8) | (raw->msg[idx+1]); > =C2=A0 idx +=3D 2; > - if (idx > raw->curlen) > + if (idx + 2 > raw->curlen) > =C2=A0 goto fail_len; > =C2=A0 repmsg->u.path_resources.avail_payload_bw_number =3D (raw- > >msg[idx] << 8) | (raw->msg[idx+1]); > - idx +=3D 2; > - if (idx > raw->curlen) > - goto fail_len; > =C2=A0 return true; > =C2=A0fail_len: > =C2=A0 DRM_DEBUG_KMS("enum resource parse length fail %d %d\n", > idx, raw->curlen); > @@ -958,10 +957,9 @@ static bool > drm_dp_sideband_parse_allocate_payload_ack(struct drm_dp_sideband_ms > =C2=A0 idx++; > =C2=A0 if (idx > raw->curlen) > =C2=A0 goto fail_len; > - repmsg->u.allocate_payload.allocated_pbn =3D (raw->msg[idx] << > 8) | (raw->msg[idx+1]); > - idx +=3D 2; > - if (idx > raw->curlen) > + if (idx + 2 > raw->curlen) > =C2=A0 goto fail_len; > + repmsg->u.allocate_payload.allocated_pbn =3D (raw->msg[idx] << > 8) | (raw->msg[idx+1]); > =C2=A0 return true; > =C2=A0fail_len: > =C2=A0 DRM_DEBUG_KMS("allocate payload parse length fail %d %d\n", > idx, raw->curlen); > @@ -977,10 +975,9 @@ static bool > drm_dp_sideband_parse_query_payload_ack(struct drm_dp_sideband_msg_r > =C2=A0 idx++; > =C2=A0 if (idx > raw->curlen) > =C2=A0 goto fail_len; > - repmsg->u.query_payload.allocated_pbn =3D (raw->msg[idx] << 8) > | (raw->msg[idx + 1]); > - idx +=3D 2; > - if (idx > raw->curlen) > + if (idx + 2 > raw->curlen) > =C2=A0 goto fail_len; > + repmsg->u.query_payload.allocated_pbn =3D (raw->msg[idx] << 8) > | (raw->msg[idx + 1]); > =C2=A0 return true; > =C2=A0fail_len: > =C2=A0 DRM_DEBUG_KMS("query payload parse length fail %d %d\n", > idx, raw->curlen);