In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Clamp VBIOS HDMI retimer register count to array size

[Why & How] The VBIOS integrated info tables (v111 and v21) contain HdmiRegNum and Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C register settings into fixed-size arrays (dpexthdmiregsettings[9] and dpexthdmi6gregsettings[3]). These u8 fields are not validated before use, so a malformed VBIOS can specify values up to 255, causing an out-of-bounds heap write during driver probe.

Clamp each register count to the destination array size using mint() before the copy loops, in both getintegratedinfov11() and getintegratedinfov21().

(cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69)

drm/amd/display: Bound VBIOS record-chain walk loops

drm/amd/display: Clamp HDMI HDCP2 rxidlist read to buffer size

drm/amd/display: Add signal type check for dcn401 getphyd32clksrc

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Add NULL pointer checks in dcstream cursor attribute functions

The function dcstreamsetcursorattributes() currently dereferences the stream pointer and nested members stream->ctx->dc->currentstate without checking for NULL.

All callers of these functions, such as in dcn30applyidlepoweroptimizations() and amdgpudmplanehandlecursorupdate(), already perform NULL checks before calling these functions.

Fixes below: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dcstream.c:336 dcstreamprogramcursorattributes() error: we previously assumed 'stream' could be null (see line 334)

drivers/gpu/drm/amd/amdgpu/../display/dc/core/dcstream.c 327 bool dcstreamprogramcursorattributes( 328 struct dcstreamstate stream, 329 const struct dccursorattributes attributes) 330 { 331 struct dc dc; 332 bool resetidleoptimizations = false; 333 334 dc = stream ? stream->ctx->dc : NULL; ^^^^^^ The old code assumed stream could be NULL.

335 --> 336 if (dcstreamsetcursorattributes(stream, attributes)) { ^^^^^^ The refactor added an unchecked dereference.

drivers/gpu/drm/amd/amdgpu/../display/dc/core/dcstream.c 313 bool dcstreamsetcursorattributes( 314 struct dcstreamstate stream, 315 const struct dccursorattributes attributes) 316 { 317 bool result = false; 318 319 if (dcstreamcheckcursorattributes(stream, stream->ctx->dc->currentstate, attributes)) { ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here. This function used to check for if stream as NULL and return false at the start. Probably we should add that back.