diff options
Diffstat (limited to 'meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/4513-drm-amd-display-Fix-static-analysis-bug-in-validate_.patch')
-rw-r--r-- | meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/4513-drm-amd-display-Fix-static-analysis-bug-in-validate_.patch | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/4513-drm-amd-display-Fix-static-analysis-bug-in-validate_.patch b/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/4513-drm-amd-display-Fix-static-analysis-bug-in-validate_.patch new file mode 100644 index 00000000..73c36f1f --- /dev/null +++ b/meta-amd-bsp/recipes-kernel/linux/linux-yocto-4.19.8/4513-drm-amd-display-Fix-static-analysis-bug-in-validate_.patch @@ -0,0 +1,45 @@ +From e90602e57aacf7202229cb99d213ff0ce8954699 Mon Sep 17 00:00:00 2001 +From: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com> +Date: Wed, 6 Nov 2019 14:58:45 -0500 +Subject: [PATCH 4513/4736] drm/amd/display: Fix static analysis bug in + validate_bksv + +[Why] +static analysis throws the error below + +Out-of-bounds read (OVERRUN) +Overrunning array of 5 bytes at byte offset 7 by dereferencing pointer +(uint64_t *)hdcp->auth.msg.hdcp1.bksv. + +var n is going to contain r0p and bcaps. if they are non-zero the count +will be wrong + +How] +Use memcpy instead to avoid this. + +Signed-off-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com> +Reviewed-by: Harry Wentland <harry.wentland@amd.com> +--- + drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c +index 4d11041a8c6f..04845e43df15 100644 +--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c ++++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c +@@ -27,9 +27,11 @@ + + static inline enum mod_hdcp_status validate_bksv(struct mod_hdcp *hdcp) + { +- uint64_t n = *(uint64_t *)hdcp->auth.msg.hdcp1.bksv; ++ uint64_t n = 0; + uint8_t count = 0; + ++ memcpy(&n, hdcp->auth.msg.hdcp1.bksv, sizeof(uint64_t)); ++ + while (n) { + count++; + n &= (n - 1); +-- +2.17.1 + |