RE: [PATCH] drm/i915/hdcp: check streams[] bounds before overflow

[Jani Nikula <jani.nikula@intel.com>]

On Sat, 27 Jun 2026, "Kandpal, Suraj" <suraj.kandpal@intel.com> wrote:
>> Subject: [PATCH] drm/i915/hdcp: check streams[] bounds before overflow
>> 
>> The data->streams[] overflow check is done after the buffer overflow has
>> already happened. Move the overflow check before the write.
>> 
>> Side note, emitting a warning splat with a backtrace might be overkill here, but
>> prefer not changing the behaviour other than not doing the overrun.
>> 
>> Discovered using AI-assisted static analysis confirmed by Intel Product Security.
>> 
>> Reported-by: Martin Hodo <martin.hodo@intel.com>
>> Fixes: e03187e12cae ("drm/i915/hdcp: MST streams support in hdcp
>> port_data")
>> Cc: <stable@vger.kernel.org> # v5.12+
>> Cc: Anshuman Gupta <anshuman.gupta@intel.com>
>> Cc: Suraj Kandpal <suraj.kandpal@intel.com>
>> Signed-off-by: Jani Nikula <jani.nikula@intel.com>
>
> LGTM,
> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>

Thanks for the review, pushed to din.

BR,
Jani.


>
>> ---
>>  drivers/gpu/drm/i915/display/intel_hdcp.c | 5 ++++-
>>  1 file changed, 4 insertions(+), 1 deletion(-)
>> 
>> diff --git a/drivers/gpu/drm/i915/display/intel_hdcp.c
>> b/drivers/gpu/drm/i915/display/intel_hdcp.c
>> index e88fec24af49..521786a75c42 100644
>> --- a/drivers/gpu/drm/i915/display/intel_hdcp.c
>> +++ b/drivers/gpu/drm/i915/display/intel_hdcp.c
>> @@ -145,6 +145,9 @@ intel_hdcp_required_content_stream(struct
>> intel_atomic_state *state,
>>  		if (!new_conn_state || !new_conn_state->crtc)
>>  			continue;
>> 
>> +		if (drm_WARN_ON(display->drm, data->k >=
>> INTEL_NUM_PIPES(display)))
>> +			return -EINVAL;
>> +
>>  		data->streams[data->k].stream_id =
>>  			intel_conn_to_vcpi(state, connector);
>>  		data->k++;
>> @@ -155,7 +158,7 @@ intel_hdcp_required_content_stream(struct
>> intel_atomic_state *state,
>>  	}
>>  	drm_connector_list_iter_end(&conn_iter);
>> 
>> -	if (drm_WARN_ON(display->drm, data->k > INTEL_NUM_PIPES(display)
>> || data->k == 0))
>> +	if (drm_WARN_ON(display->drm, !data->k))
>>  		return -EINVAL;
>> 
>>  	/*
>> --
>> 2.47.3
>

-- 
Jani Nikula, Intel