mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-12 07:13:10 -04:00
Code Issues Packages Projects Releases Wiki Activity

drm/gud: validate TV mode names before creating enum property

Browse Source 
The GUD protocol returns TV mode names as fixed-size
GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be
NUL-terminated.

gud_connector_add_tv_mode() currently passes each fixed-size entry
directly to drm_mode_create_tv_properties_legacy(), which eventually
reaches drm_property_add_enum() and strlen(). If a device returns an
entry without a terminating NUL byte, strlen() reads past the end of
the slot and can run beyond the allocated buffer, triggering an
out-of-bounds read.

Validate that each returned TV mode name contains a NUL terminator
within its fixed-size slot before passing it to the DRM property code.
If a malformed entry is found, reject the device response with -EIO.

This fixes the out-of-bounds read without changing the handling of
valid devices, and avoids silently truncating malformed protocol data.

Reported-by: syzbot+9ae8e7884e451eaed5b4@syzkaller.appspotmail.com
Fixes: 40e1a70b4a ("drm: Add GUD USB Display driver")
Signed-off-by: Tao Yu <tao1.yu@intel.com>
Reviewed-by: Ruben Wauters <rubenru09@aol.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Ruben Wauters <rubenru09@aol.com>
Link: https://patch.msgid.link/20260819072835.4074130-1-tao1.yu@intel.com
This commit is contained in:
Tao Yu
2026-08-19 15:28:35 +08:00
committed by Ruben Wauters
parent 500cb24cd6
commit da1ea35fea
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/gpu/drm/gud/gud_connector.c
View File

@@ -399,8 +399,11 @@ static int gud_connector_add_tv_mode(struct gud_device *gdrm, struct drm_connect
for (i = 0; i < num_modes; i++) {
char *mode = &buf[i * GUD_CONNECTOR_TV_MODE_NAME_LEN];
/* The device is not trusted to NUL-terminate the name */
mode[GUD_CONNECTOR_TV_MODE_NAME_LEN - 1] = '\0';
if (!memchr(mode, '\0', GUD_CONNECTOR_TV_MODE_NAME_LEN)) {
ret = -EIO;
goto free;
}
modes[i] = mode;
}