diff options
| author | Luca Coelho <luciano.coelho@intel.com> | 2025-09-09 11:30:11 +0300 |
|---|---|---|
| committer | Luca Coelho <luciano.coelho@intel.com> | 2025-09-19 12:50:56 +0300 |
| commit | db7944458f4e5cdc11402e18ccbbc7aac4286f4b (patch) | |
| tree | 3ced26fe4c11d0af736c4c85c642ebdf7a75b292 /drivers/gpu | |
| parent | cef58ce505a04a896d59cb207f0a0ccea1eec5ca (diff) | |
| download | linux-db7944458f4e5cdc11402e18ccbbc7aac4286f4b.tar.gz linux-db7944458f4e5cdc11402e18ccbbc7aac4286f4b.zip | |
drm/i915/dmc: explicitly sanitize num_entries from package_header
num_entries comes from package_header, which is read from an external
firmware blob and thus untrusted. In parse_dmc_fw_package() we assign
package_header->num_entries to a local variable, but the range check
still uses the struct field directly.
Switch the check to use the local copy instead. This makes the
sanitization explicit and avoids a redundant dereference.
Reviewed-by: Mitul Golani <mitulkumar.ajitkumar.golani@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/20250909083042.1292672-1-luciano.coelho@intel.com
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/i915/display/intel_dmc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/i915/display/intel_dmc.c b/drivers/gpu/drm/i915/display/intel_dmc.c index 77a0199f9ea5..517bebb0b4aa 100644 --- a/drivers/gpu/drm/i915/display/intel_dmc.c +++ b/drivers/gpu/drm/i915/display/intel_dmc.c @@ -1141,7 +1141,7 @@ parse_dmc_fw_package(struct intel_dmc *dmc, } num_entries = package_header->num_entries; - if (WARN_ON(package_header->num_entries > max_entries)) + if (WARN_ON(num_entries > max_entries)) num_entries = max_entries; fw_info = (const struct intel_fw_info *) |