mirror of https://github.com/torvalds/linux.git
At some point, the IEEE ID identification for the replay check in the
AMD EDID was added. However, this check causes the following
out-of-bounds issues when using KASAN:
[ 27.804016] BUG: KASAN: slab-out-of-bounds in amdgpu_dm_update_freesync_caps+0xefa/0x17a0 [amdgpu]
[ 27.804788] Read of size 1 at addr ffff8881647fdb00 by task systemd-udevd/383
...
[ 27.821207] Memory state around the buggy address:
[ 27.821215] ffff8881647fda00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 27.821224] ffff8881647fda80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 27.821234] >ffff8881647fdb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 27.821243] ^
[ 27.821250] ffff8881647fdb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 27.821259] ffff8881647fdc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 27.821268] ==================================================================
This is caused because the ID extraction happens outside of the range of
the edid lenght. This commit addresses this issue by considering the
amd_vsdb_block size.
Cc: ChiaHsuan Chung <chiahsuan.chung@amd.com>
Reviewed-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| amdgpu_dm.c | ||
| amdgpu_dm.h | ||
| amdgpu_dm_color.c | ||
| amdgpu_dm_crc.c | ||
| amdgpu_dm_crc.h | ||
| amdgpu_dm_crtc.c | ||
| amdgpu_dm_crtc.h | ||
| amdgpu_dm_debugfs.c | ||
| amdgpu_dm_debugfs.h | ||
| amdgpu_dm_hdcp.c | ||
| amdgpu_dm_hdcp.h | ||
| amdgpu_dm_helpers.c | ||
| amdgpu_dm_irq.c | ||
| amdgpu_dm_irq.h | ||
| amdgpu_dm_irq_params.h | ||
| amdgpu_dm_mst_types.c | ||
| amdgpu_dm_mst_types.h | ||
| amdgpu_dm_plane.c | ||
| amdgpu_dm_plane.h | ||
| amdgpu_dm_pp_smu.c | ||
| amdgpu_dm_psr.c | ||
| amdgpu_dm_psr.h | ||
| amdgpu_dm_replay.c | ||
| amdgpu_dm_replay.h | ||
| amdgpu_dm_services.c | ||
| amdgpu_dm_trace.h | ||
| amdgpu_dm_wb.c | ||
| amdgpu_dm_wb.h | ||
| dc_fpu.c | ||
| dc_fpu.h | ||