1. Patchew
  2. linux
  3. View series

[PATCH v2] drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers

Ashutosh Desai posted 1 patch 1 month ago 
drivers/gpu/drm/display/drm_dp_mst_topology.c | 17 ++++-------------
1 file changed, 4 insertions(+), 13 deletions(-)
[PATCH v2] drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
Posted by Ashutosh Desai 1 month ago 
Three sideband reply parsers read 16-bit fields as:

  val = (raw->msg[idx] << 8) | (raw->msg[idx+1]);

and check bounds only after the fact. When idx == raw->curlen,
raw->msg[idx+1] reads one byte past the received message data into
the following struct fields (curchunk_len, curchunk_idx, curlen).

Affected functions:
 - drm_dp_sideband_parse_enum_path_resources_ack()
   full_payload_bw_number and avail_payload_bw_number fields
 - drm_dp_sideband_parse_allocate_payload_ack()
   allocated_pbn field
 - drm_dp_sideband_parse_query_payload_ack()
   allocated_pbn field

Fix by using a single combined check (idx + 2 > curlen) before each
2-byte read. Since the check is strictly tighter than idx > curlen,
no separate step is needed.

Cc: stable@vger.kernel.org
Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
---
Changes in v2:
- Drop separate idx > curlen check immediately before idx + 2 > curlen;
  the combined check strictly subsumes it (Lyude Paul)

 drivers/gpu/drm/display/drm_dp_mst_topology.c | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c
index 9416a48804c8..6e7896193772 100644
--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
@@ -925,16 +925,13 @@ static bool drm_dp_sideband_parse_enum_path_resources_ack(struct drm_dp_sideband
 	repmsg->u.path_resources.port_number = (raw->msg[idx] >> 4) & 0xf;
 	repmsg->u.path_resources.fec_capable = raw->msg[idx] & 0x1;
 	idx++;
-	if (idx > raw->curlen)
+	if (idx + 2 > raw->curlen)
 		goto fail_len;
 	repmsg->u.path_resources.full_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
 	idx += 2;
-	if (idx > raw->curlen)
+	if (idx + 2 > raw->curlen)
 		goto fail_len;
 	repmsg->u.path_resources.avail_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
-	idx += 2;
-	if (idx > raw->curlen)
-		goto fail_len;
 	return true;
 fail_len:
 	DRM_DEBUG_KMS("enum resource parse length fail %d %d\n", idx, raw->curlen);
@@ -952,12 +949,9 @@ static bool drm_dp_sideband_parse_allocate_payload_ack(struct drm_dp_sideband_ms
 		goto fail_len;
 	repmsg->u.allocate_payload.vcpi = raw->msg[idx];
 	idx++;
-	if (idx > raw->curlen)
+	if (idx + 2 > raw->curlen)
 		goto fail_len;
 	repmsg->u.allocate_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
-	idx += 2;
-	if (idx > raw->curlen)
-		goto fail_len;
 	return true;
 fail_len:
 	DRM_DEBUG_KMS("allocate payload parse length fail %d %d\n", idx, raw->curlen);
@@ -971,12 +965,9 @@ static bool drm_dp_sideband_parse_query_payload_ack(struct drm_dp_sideband_msg_r
 
 	repmsg->u.query_payload.port_number = (raw->msg[idx] >> 4) & 0xf;
 	idx++;
-	if (idx > raw->curlen)
+	if (idx + 2 > raw->curlen)
 		goto fail_len;
 	repmsg->u.query_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx + 1]);
-	idx += 2;
-	if (idx > raw->curlen)
-		goto fail_len;
 	return true;
 fail_len:
 	DRM_DEBUG_KMS("query payload parse length fail %d %d\n", idx, raw->curlen);
-- 
2.34.1
Re: [PATCH v2] drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
Posted by lyude@redhat.com 3 weeks, 4 days ago 
Reviewed-by: Lyude Paul <lyude@redhat.com>

Will push to drm-misc-next in just a moment

On Sun, 2026-05-10 at 20:31 +0000, Ashutosh Desai wrote:
> Three sideband reply parsers read 16-bit fields as:
> 
>   val = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
> 
> and check bounds only after the fact. When idx == raw->curlen,
> raw->msg[idx+1] reads one byte past the received message data into
> the following struct fields (curchunk_len, curchunk_idx, curlen).
> 
> Affected functions:
>  - drm_dp_sideband_parse_enum_path_resources_ack()
>    full_payload_bw_number and avail_payload_bw_number fields
>  - drm_dp_sideband_parse_allocate_payload_ack()
>    allocated_pbn field
>  - drm_dp_sideband_parse_query_payload_ack()
>    allocated_pbn field
> 
> Fix by using a single combined check (idx + 2 > curlen) before each
> 2-byte read. Since the check is strictly tighter than idx > curlen,
> no separate step is needed.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
> ---
> Changes in v2:
> - Drop separate idx > curlen check immediately before idx + 2 >
> curlen;
>   the combined check strictly subsumes it (Lyude Paul)
> 
>  drivers/gpu/drm/display/drm_dp_mst_topology.c | 17 ++++-------------
>  1 file changed, 4 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c
> b/drivers/gpu/drm/display/drm_dp_mst_topology.c
> index 9416a48804c8..6e7896193772 100644
> --- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
> +++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
> @@ -925,16 +925,13 @@ static bool
> drm_dp_sideband_parse_enum_path_resources_ack(struct drm_dp_sideband
>  	repmsg->u.path_resources.port_number = (raw->msg[idx] >> 4)
> & 0xf;
>  	repmsg->u.path_resources.fec_capable = raw->msg[idx] & 0x1;
>  	idx++;
> -	if (idx > raw->curlen)
> +	if (idx + 2 > raw->curlen)
>  		goto fail_len;
>  	repmsg->u.path_resources.full_payload_bw_number = (raw-
> >msg[idx] << 8) | (raw->msg[idx+1]);
>  	idx += 2;
> -	if (idx > raw->curlen)
> +	if (idx + 2 > raw->curlen)
>  		goto fail_len;
>  	repmsg->u.path_resources.avail_payload_bw_number = (raw-
> >msg[idx] << 8) | (raw->msg[idx+1]);
> -	idx += 2;
> -	if (idx > raw->curlen)
> -		goto fail_len;
>  	return true;
>  fail_len:
>  	DRM_DEBUG_KMS("enum resource parse length fail %d %d\n",
> idx, raw->curlen);
> @@ -952,12 +949,9 @@ static bool
> drm_dp_sideband_parse_allocate_payload_ack(struct drm_dp_sideband_ms
>  		goto fail_len;
>  	repmsg->u.allocate_payload.vcpi = raw->msg[idx];
>  	idx++;
> -	if (idx > raw->curlen)
> +	if (idx + 2 > raw->curlen)
>  		goto fail_len;
>  	repmsg->u.allocate_payload.allocated_pbn = (raw->msg[idx] <<
> 8) | (raw->msg[idx+1]);
> -	idx += 2;
> -	if (idx > raw->curlen)
> -		goto fail_len;
>  	return true;
>  fail_len:
>  	DRM_DEBUG_KMS("allocate payload parse length fail %d %d\n",
> idx, raw->curlen);
> @@ -971,12 +965,9 @@ static bool
> drm_dp_sideband_parse_query_payload_ack(struct drm_dp_sideband_msg_r
>  
>  	repmsg->u.query_payload.port_number = (raw->msg[idx] >> 4) &
> 0xf;
>  	idx++;
> -	if (idx > raw->curlen)
> +	if (idx + 2 > raw->curlen)
>  		goto fail_len;
>  	repmsg->u.query_payload.allocated_pbn = (raw->msg[idx] << 8)
> | (raw->msg[idx + 1]);
> -	idx += 2;
> -	if (idx > raw->curlen)
> -		goto fail_len;
>  	return true;
>  fail_len:
>  	DRM_DEBUG_KMS("query payload parse length fail %d %d\n",
> idx, raw->curlen);

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.