From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id EC72CC43458 for ; Mon, 29 Jun 2026 08:37:40 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id A999810E064; Mon, 29 Jun 2026 08:37:40 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=intel.com header.i=@intel.com header.b="IJcCJLZQ"; dkim-atps=neutral Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.15]) by gabe.freedesktop.org (Postfix) with ESMTPS id 0163A10E064; Mon, 29 Jun 2026 08:37:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1782722260; x=1814258260; h=from:to:cc:subject:in-reply-to:references:date: message-id:mime-version; bh=npwcDl1Hy2s+m0+wVi0Quc/JHORszY3gdPIGD7SMNJY=; b=IJcCJLZQoVsltKaPJ+6YVoPmpVcSOkkHNzI5W04w3LZuIdVPctNqbaoe BbKKy05lPNjZo0nwfATajd4QDP9/aBN6WSLeEmXkJNzd4e7XOLsayCzp4 8iqNCSdSp8BMAaHh74iHL7IhNXZJR3ZYwUPnb2XrAfMauBhAeY3MkL3Ts RKme4R1RRisyx7qO6FS1x/SIO1MIVeu052D9zmlKVj1edDmsWhlWVSEVf nPM31aH7mvH5s58tAsDkzRKZYirOF9VPBfYLudxAYahRRS5/HYHXdhK0W Jy2tj6Bpy1Zz3VFybKyodrKhTWWdV62c4Z66OR9Q2dEG/5pG1K6PJbGgs Q==; X-CSE-ConnectionGUID: V5+TrBq1RV6mmtVXCgj77g== X-CSE-MsgGUID: +G2SGjvyTPK/frhS+fudew== X-IronPort-AV: E=McAfee;i="6800,10657,11831"; a="87098161" X-IronPort-AV: E=Sophos;i="6.24,231,1774335600"; d="scan'208";a="87098161" Received: from fmviesa003.fm.intel.com ([10.60.135.143]) by orvoesa107.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Jun 2026 01:37:40 -0700 X-CSE-ConnectionGUID: SBh23sn9QW2WxfZMj+T9ug== X-CSE-MsgGUID: Ub5XMegeQnG2vLtGvjuvyQ== X-ExtLoop1: 1 Received: from carterle-desk.ger.corp.intel.com (HELO localhost) ([10.245.244.253]) by fmviesa003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Jun 2026 01:37:37 -0700 From: Jani Nikula To: "Kandpal, Suraj" , "intel-gfx@lists.freedesktop.org" , "intel-xe@lists.freedesktop.org" Cc: "Hodo, Martin" , "stable@vger.kernel.org" , "Gupta, Anshuman" Subject: RE: [PATCH] drm/i915/hdcp: check streams[] bounds before overflow In-Reply-To: Organization: Intel Finland Oy - BIC 0357606-4 - c/o Alberga Business Park, 6 krs Bertel Jungin Aukio 5, 02600 Espoo, Finland References: <20260625170304.1104723-1-jani.nikula@intel.com> Date: Mon, 29 Jun 2026 11:37:35 +0300 Message-ID: MIME-Version: 1.0 Content-Type: text/plain X-BeenThere: intel-xe@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel Xe graphics driver List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-xe-bounces@lists.freedesktop.org Sender: "Intel-xe" On Sat, 27 Jun 2026, "Kandpal, Suraj" wrote: >> Subject: [PATCH] drm/i915/hdcp: check streams[] bounds before overflow >> >> The data->streams[] overflow check is done after the buffer overflow has >> already happened. Move the overflow check before the write. >> >> Side note, emitting a warning splat with a backtrace might be overkill here, but >> prefer not changing the behaviour other than not doing the overrun. >> >> Discovered using AI-assisted static analysis confirmed by Intel Product Security. >> >> Reported-by: Martin Hodo >> Fixes: e03187e12cae ("drm/i915/hdcp: MST streams support in hdcp >> port_data") >> Cc: # v5.12+ >> Cc: Anshuman Gupta >> Cc: Suraj Kandpal >> Signed-off-by: Jani Nikula > > LGTM, > Reviewed-by: Suraj Kandpal Thanks for the review, pushed to din. BR, Jani. > >> --- >> drivers/gpu/drm/i915/display/intel_hdcp.c | 5 ++++- >> 1 file changed, 4 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/gpu/drm/i915/display/intel_hdcp.c >> b/drivers/gpu/drm/i915/display/intel_hdcp.c >> index e88fec24af49..521786a75c42 100644 >> --- a/drivers/gpu/drm/i915/display/intel_hdcp.c >> +++ b/drivers/gpu/drm/i915/display/intel_hdcp.c >> @@ -145,6 +145,9 @@ intel_hdcp_required_content_stream(struct >> intel_atomic_state *state, >> if (!new_conn_state || !new_conn_state->crtc) >> continue; >> >> + if (drm_WARN_ON(display->drm, data->k >= >> INTEL_NUM_PIPES(display))) >> + return -EINVAL; >> + >> data->streams[data->k].stream_id = >> intel_conn_to_vcpi(state, connector); >> data->k++; >> @@ -155,7 +158,7 @@ intel_hdcp_required_content_stream(struct >> intel_atomic_state *state, >> } >> drm_connector_list_iter_end(&conn_iter); >> >> - if (drm_WARN_ON(display->drm, data->k > INTEL_NUM_PIPES(display) >> || data->k == 0)) >> + if (drm_WARN_ON(display->drm, !data->k)) >> return -EINVAL; >> >> /* >> -- >> 2.47.3 > -- Jani Nikula, Intel