From 560c8523c4ebf927fba16206767db222bfb9a5b1 Mon Sep 17 00:00:00 2001 From: jsg Date: Mon, 19 Jul 2021 10:05:24 +0000 Subject: [PATCH] drm/amd/display: Avoid HDCP over-read and corruption From Kees Cook c5b518f4b98dbb2bc31b6a55e6aaa1e0e2948f2e in linux 5.10.y/5.10.51 06888d571b513cbfc0b41949948def6cb81021b2 in mainline linux --- sys/dev/pci/drm/amd/display/modules/hdcp/hdcp1_execution.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sys/dev/pci/drm/amd/display/modules/hdcp/hdcp1_execution.c b/sys/dev/pci/drm/amd/display/modules/hdcp/hdcp1_execution.c index f244b72e74e..53eab2b8e2c 100644 --- a/sys/dev/pci/drm/amd/display/modules/hdcp/hdcp1_execution.c +++ b/sys/dev/pci/drm/amd/display/modules/hdcp/hdcp1_execution.c @@ -29,8 +29,10 @@ static inline enum mod_hdcp_status validate_bksv(struct mod_hdcp *hdcp) { uint64_t n = 0; uint8_t count = 0; + u8 bksv[sizeof(n)] = { }; - memcpy(&n, hdcp->auth.msg.hdcp1.bksv, sizeof(uint64_t)); + memcpy(bksv, hdcp->auth.msg.hdcp1.bksv, sizeof(hdcp->auth.msg.hdcp1.bksv)); + n = *(uint64_t *)bksv; while (n) { count++; -- 2.20.1