The DMC firmware parser does not validate the firmware load address stored in version 3 headers before it is used by dmc_load_program().
The firmware size conversion from dwords to bytes can overflow while calculating the payload size. Fix both by validating the firmware load address against the expected range and using check_mul_overflow() for the firmware size conversion. Dibin Moolakadan Subrahmanian (2): drm/i915/dmc: Add sanity check for DMC load address drm/i915/dmc: Prevent fw_size multiplication overflow drivers/gpu/drm/i915/display/intel_dmc.c | 84 ++++++++++++++++--- drivers/gpu/drm/i915/display/intel_dmc_regs.h | 12 +++ 2 files changed, 85 insertions(+), 11 deletions(-) -- 2.43.0
