From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E0F0A4BEE25; Sat, 12 Sep 2026 10:03:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789207431; cv=none; b=GIupRpWouuZwz9PRJakKDgWZ2xH0b5GicpEP8aFAvQurHh6iVywFwz7OxpFaHCC9MPSGtdE7cxG0m2mQei7XGUp1N1O8UC40vHgpsmMNgydiIENnGJmdcDJeTiJn/7J3Qe6W8vkh9PC81a4+du7PYE860xWkknE7JVijo0b414I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789207431; c=relaxed/simple; bh=Sh7CleKO9mEQrM4eAegyf20SBCvpYg8tNqQFeoJG4ro=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LxkHAsdGf61ILtouyXqDm6jyQeEXyHMC4nr0yogascJRraTAYucT2TmEdNNu1gaQgEQJTBPhyh0fkU8tGORcnQ7Uto8yc47gxrmR2/iInud0cpN/xyIiJPcgtwjrUSDsFR37qU71AYx4BVrwiqFg5q9Qm9f4r+UOMTaO3sPurjo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=pK+TGyao; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="pK+TGyao" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D65131F000FF; Sat, 12 Sep 2026 10:03:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789207429; bh=ChUopa+zz66P7KD3C7aa2MuhxEXxBFfgPDR2Ow6zyEg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=pK+TGyaok3kf23edHLhso3fkj6ZYEl5zZeqpk8kNgtKWpXcXnEO6hEccD7HLLwOP+ v58CMlBZC6Cp5nzzZvgTUtSabvZN5mrqNkEcj21SCzuBmF7JMfzuLE+vrojhw6uOuJ iBzHHpnppSuXuBmJ5yHEsErNtJm0ou8cCfB6OwlQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Kaixuan Li , Maoyi Xie , Douglas Anderson , Sasha Levin Subject: [PATCH 6.18 0409/1518] drm/bridge: tc358767: clamp the reported AUX read size to the request Date: Sat, 12 Sep 2026 08:42:58 +0200 Message-ID: <20260912065632.710579653@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260912065623.398859879@linuxfoundation.org> References: <20260912065623.398859879@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Maoyi Xie [ Upstream commit ec6444a00c49e6c2b5e9a507272a28126677f9ee ] tc_aux_transfer() clamps an AUX read to the payload limit: size_t size = min_t(size_t, DP_AUX_MAX_PAYLOAD_BYTES - 1, msg->size); After the transfer it replaces size with the byte count the controller reports in AUX_BYTES: if (size) size = FIELD_GET(AUX_BYTES, auxstatus); AUX_BYTES is GENMASK(15, 8), so it can be up to 255. Nothing clamps it back to the request. tc_aux_read_data() reads that many bytes into the 16-byte auxrdata stack buffer, then copies them into the caller buffer. A reported count of 255 makes the read run to 256 bytes and overruns both. The controller should never report more than it was asked to transfer, so this is defense in depth rather than a live hole. The reported count is only lightly trusted, and the check is cheap. Clamp it back to the request, the same way ti-sn65dsi86 does in commit aca58eac52b8 ("drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in AUX xfer"). Fixes: 12dfe7c4d9c5 ("drm/bridge: tc358767: Use reported AUX transfer size") Co-developed-by: Kaixuan Li Signed-off-by: Kaixuan Li Signed-off-by: Maoyi Xie Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patch.msgid.link/20260701064440.1541418-1-maoyixie.tju@gmail.com Signed-off-by: Sasha Levin --- drivers/gpu/drm/bridge/tc358767.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c index 4097fef4b86b5..26ba5a6c1b742 100644 --- a/drivers/gpu/drm/bridge/tc358767.c +++ b/drivers/gpu/drm/bridge/tc358767.c @@ -527,7 +527,7 @@ static ssize_t tc_aux_transfer(struct drm_dp_aux *aux, * address-only transfer */ if (size) - size = FIELD_GET(AUX_BYTES, auxstatus); + size = min_t(size_t, size, FIELD_GET(AUX_BYTES, auxstatus)); msg->reply = FIELD_GET(AUX_STATUS, auxstatus); switch (request) { -- 2.53.0