The DMC firmware parser does not validate the firmware load address stored in version 3 headers before it is used by dmc_load_program().
The firmware size conversion from dwords to bytes can overflow while calculating the payload size. Fix both by validating the firmware load address against the expected range and using check_mul_overflow() for the firmware size conversion. v2: Added Fixes tag in commit messages for both patches. v3: Address Sashiko's parser-hardening review comments in patch 2. Dibin Moolakadan Subrahmanian (2): drm/i915/dmc: Add sanity check for DMC load address drm/i915/dmc: Harden DMC firmware payload parsing drivers/gpu/drm/i915/display/intel_dmc.c | 95 ++++++++++++++++--- drivers/gpu/drm/i915/display/intel_dmc_regs.h | 12 +++ 2 files changed, 93 insertions(+), 14 deletions(-) -- 2.43.0
