[PATCH] drm/ast: validate framebuffer VRAM size in ast_mode.c and DP501 firmware bounds

[PATCH] drm/ast: validate framebuffer VRAM size in ast_mode.c and DP501 firmware bounds

[Hui Peng]

In drivers/gpu/drm/ast/ (ast_mode.c, ast_dp501.c), verify that the
primary plane framebuffer fits within ast->vram_size and bounds-check
DP501 firmware headers.

Fixes: 312fec1405dd ("drm: Initial KMS driver for AST (ASpeed Technologies) 2000 series (v2)")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/drivers/gpu/drm/ast/ast_dp501.c b/drivers/gpu/drm/ast/ast_dp501.c
index 6d6ccfad1415..d9ca8760e5b5 100644
--- a/drivers/gpu/drm/ast/ast_dp501.c
+++ b/drivers/gpu/drm/ast/ast_dp501.c
@@ -250,7 +250,8 @@ static bool ast_launch_m68k(struct ast_device *ast)
 
 		/* copy image to buffer */
 		for (i = 0; i < len; i += 4) {
-			data = *(u32 *)(fw_addr + i);
+			data = 0;
+			memcpy(&data, fw_addr + i, min_t(u32, len - i, 4));
 			ast_moutdwm(ast, boot_address + i, data);
 		}
 
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
index d5ed8c5c7925..bde9dcbbc32b 100644
--- a/drivers/gpu/drm/ast/ast_mode.c
+++ b/drivers/gpu/drm/ast/ast_mode.c
@@ -510,6 +510,7 @@ static int ast_primary_plane_helper_atomic_check(struct drm_plane *plane,
 						 struct drm_atomic_commit *state)
 {
 	struct drm_device *dev = plane->dev;
+	struct ast_plane *ast_plane = to_ast_plane(plane);
 	struct drm_plane_state *new_plane_state = drm_atomic_get_new_plane_state(state, plane);
 	struct drm_crtc_state *new_crtc_state = NULL;
 	struct ast_crtc_state *new_ast_crtc_state;
@@ -531,6 +532,11 @@ static int ast_primary_plane_helper_atomic_check(struct drm_plane *plane,
 			return 0;
 	}
 
+	if (new_plane_state->fb->pitches[0] > AST_PRIMARY_PLANE_MAX_OFFSET)
+		return -EINVAL;
+	if ((u64)new_plane_state->fb->pitches[0] * new_plane_state->fb->height > ast_plane->size)
+		return -ENOSPC;
+
 	new_ast_crtc_state = to_ast_crtc_state(new_crtc_state);
 
 	new_ast_crtc_state->format = new_plane_state->fb->format;

Re: [PATCH] drm/ast: validate framebuffer VRAM size in ast_mode.c and DP501 firmware bounds

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] ast: commit message and code mismatch regarding DP501 bounds check
--

commit 7c7f87df86011f4f2e1f7815297b6468c2302228
Author: Hui Peng <benquike@gmail.com>

drm/ast: validate framebuffer VRAM size in ast_mode.c and DP501 firmware bounds

This commit adds bounds checking for the primary plane framebuffer size
against the vram_size. It also updates the DP501 firmware copy loop in
ast_dp501.c to prevent out-of-bounds memory accesses.

> In drivers/gpu/drm/ast/ (ast_mode.c, ast_dp501.c), verify that the
> primary plane framebuffer fits within ast->vram_size and bounds-check
> DP501 firmware headers.

> diff --git a/drivers/gpu/drm/ast/ast_dp501.c b/drivers/gpu/drm/ast/ast_dp501.c
> index 6d6ccfad14154..d9ca8760e5b51 100644
> --- a/drivers/gpu/drm/ast/ast_dp501.c
> +++ b/drivers/gpu/drm/ast/ast_dp501.c
> @@ -250,7 +250,8 @@ static bool ast_launch_m68k(struct ast_device *ast)
>  
>  		/* copy image to buffer */
>  		for (i = 0; i < len; i += 4) {
> -			data = *(u32 *)(fw_addr + i);
> +			data = 0;
> +			memcpy(&data, fw_addr + i, min_t(u32, len - i, 4));

[Severity: Medium]
Is the commit message accurate regarding DP501 firmware headers?

The commit message claims to "bounds-check DP501 firmware headers", but
ast_launch_m68k() adds a bounds check to the firmware payload copy loop
instead.

Since the driver reads DP501 headers directly from mapped hardware memory
rather than the host buffer, there are no headers in the host buffer to
bounds-check.

Could the commit message be updated to describe this payload copy bounds
check instead of firmware headers?

>  			ast_moutdwm(ast, boot_address + i, data);
>  		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919223516.3889946-1-benquike@gmail.com?part=1