drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
PATCH 1/1 drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
From: Suraj Kandpal <[email protected]>
[ Upstream commit 31b42af516afa1e184d1a9f9dd4096c54044269a ]
Sometimes during hotplug scenario or suspend/resume scenario encoder is not always initialized when intel_hdcp_get_capability add
a check to avoid kernel null pointer dereference.
---
Hi Greg, Sasha, and drm i915 maintainers,
I am working through the small CVE backports still missing from 6.6.y. This one addresses CVE-2024-53051. It rejects the HDCP capability query when hotplug or resume left the encoder unset.
The fix is already present in 6.12.y, 6.18.y, and 7.2.y, but not in 6.6.y. This fix also affects 6.1.y, which will need a separate backport; this submission contains only the 6.6.y patch.
The code change is identical to upstream.
Could you please queue it for 6.6.y?
CVE: CVE-2024-53051
Upstream: 31b42af516afa1e184d1a9f9dd4096c54044269a
AI assistance: An LLM helped identify, adapt, and validate this backport; I reviewed the resulting code and validation evidence.
Thanks,
Artem Dinaburg
drivers/gpu/drm/i915/display/intel_hdcp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/display/intel_hdcp.c +6 -1
@@ -142,11 +142,16 @@ int intel_hdcp_read_valid_bksv(struct intel_digital_port *dig_port,/* Is HDCP1.4 capable on Platform and Sink */ bool intel_hdcp_capable (struct intel_connector *connector) { -struct intel_digital_port *dig_port =intel_attached_dig_port (connector); +struct intel_digital_port *dig_port;const struct intel_hdcp_shim *shim = connector->hdcp.shim;bool capable = false;u8 bksv[5 ]; +if (!intel_attached_encoder (connector)) +return capable; + + dig_port =intel_attached_dig_port (connector); +if (!shim)return capable;
Signature · 1 line
2.39.5
Patchwork
CI✗ LGCI.VerificationFailed: failure for drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
== Series Details ==
== Series Details ==
Series: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
URL : https://patchwork.freedesktop.org/series/175223/
State : failure
== Summary ==
Series author address '[email protected]' is not on the allowlist, which prevents CI from being automatically triggered. If you want CI to run for this series, ask Patchwork project owners to click 'retest' on the series in Patchwork. Exception occurred during validation, bailing out!
Build URL: http://intel-gfx-ci-public.igk.intel.com:8080/job/xe_pw_trigger/1295712/ (on master)
Patchwork
CI✗ LGCI.VerificationFailed: failure for drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
In reply to Artem Dinaburg== Series Details ==
== Series Details ==
Series: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
URL : https://patchwork.freedesktop.org/series/175224/
State : failure
== Summary ==
Series author address '[email protected]' is not on the allowlist, which prevents CI from being automatically triggered. If you want CI to run for this series, ask Patchwork project owners to click 'retest' on the series in Patchwork. Exception occurred during validation, bailing out!
Build URL: http://gfx-ci.igk.intel.com:8080/job/CI_PW_kernel/188780/ (on built-in)
Sasha Levin
maintainerQuoted 4 lines
bool
intel_hdcp_capable(struct intel_connector *connector){drivers/gpu/drm/i915/display/intel_hdcp.c +1
-1-struct intel_digital_port *dig_port =intel_attached_dig_port (connector); +struct intel_digital_port *dig_port;
[...]
drivers/gpu/drm/i915/display/intel_hdcp.c int intel_hdcp_read_valid_bksv(struct intel_digital_port *dig_port, · line 151
Quoted 2 lines
drivers/gpu/drm/i915/display/intel_hdcp.c +2
-0+if (!intel_attached_encoder (connector)) +return capable;
On 6.6 this doesn't stop the oops. The debugfs intel_hdcp_info() calls intel_hdcp2_capable() right after intel_hdcp_capable(), and intel_hdcp2_capable() still starts with intel_attached_dig_port(connector) without an encoder check, so the NULL deref just moves one call later.
Upstream fixed that half in d34f4f058edf ("drm/i915/hdcp: Add encoder check in hdcp2_get_capability"), CVE-2024-53050. Its CVE record says the bug arrived in 6.7, but 130849f8ec14 ("drm/i915/hdcp: Use intel_connector as argument for hdcp_2_2_capable") only moved the deref into the DP/HDMI shims. 6.6 still has it in intel_hdcp2_capable() itself.
Could you resend this as a 2-patch 6.6.y series: this backport plus a 6.6 adaptation of the hdcp2 fix that guards intel_hdcp2_capable()?
Signature · 2 lines
Thanks, Sasha