drm/amd/display: Check index msg_id before read or write

From Alex Hung
9933eca6ada0cd612e19522e7a319bcef464c0eb in linux-6.6.y/6.6.39
59d99deb330af206a4541db0c4da8f73880fba03 in mainline linux

diff --git a/sys/dev/pci/drm/amd/display/modules/hdcp/hdcp_ddc.c b/sys/dev/pci/drm/amd/display/modules/hdcp/hdcp_ddc.c
index 352a94b..0f345a2 100644 (file)
--- a/sys/dev/pci/drm/amd/display/modules/hdcp/hdcp_ddc.c
+++ b/sys/dev/pci/drm/amd/display/modules/hdcp/hdcp_ddc.c
@@ -158,6 +158,10 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp,
        uint32_t cur_size = 0;
        uint32_t data_offset = 0;
 
+       if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) {
+               return MOD_HDCP_STATUS_DDC_FAILURE;
+       }
+
        if (is_dp_hdcp(hdcp)) {
                while (buf_len > 0) {
                        cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);
@@ -217,6 +221,10 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp,
        uint32_t cur_size = 0;
        uint32_t data_offset = 0;
 
+       if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) {
+               return MOD_HDCP_STATUS_DDC_FAILURE;
+       }
+
        if (is_dp_hdcp(hdcp)) {
                while (buf_len > 0) {
                        cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);