From effb787b85fe0caac38cb40af8cf40161ca76f43 Mon Sep 17 00:00:00 2001 From: Sean Paul Date: Thu, 7 Sep 2017 14:49:03 -0400 Subject: [PATCH] CHROMIUM: drm/rockchip: Enforce cdn_dp_hdcp_key_1x size assumption struct cdn_dp_hdcp_key_1x is assumed to be evenly divisible by 6, given its usage and reserved member. Unfortunately, this is neither documented, nor enforced anywhere. This patch fixes that. BUG=b:63816472 TEST=Builds Signed-off-by: Sean Paul Reviewed-on: https://chromium-review.googlesource.com/657576 Commit-Ready: Sean Paul Tested-by: Sean Paul Reviewed-by: Douglas Anderson Reviewed-by: Kristian H. Kristensen Change-Id: I3f683cb9dd48d6e6d104d2e9a1a94c03e34d25dd Signed-off-by: Wyon Bi --- drivers/gpu/drm/rockchip/cdn-dp-core.c | 6 +++--- drivers/gpu/drm/rockchip/cdn-dp-core.h | 3 +++ 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c index dcca05f4c2b9..367281ff343a 100644 --- a/drivers/gpu/drm/rockchip/cdn-dp-core.c +++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c @@ -215,9 +215,9 @@ static int cdn_dp_start_hdcp1x_auth(struct cdn_dp_device *dp) arm_smccc_smc(RK_SIP_HDCP_CONTROL, HDCP_KEY_DATA_START_TRANSFER, 0, 0, 0, 0, 0, 0, &res); - buf = (uint64_t *)&dp->key; - - for (; !res.a0 && (u8 *)buf - (u8 *)&dp->key < sizeof(dp->key); + BUILD_BUG_ON(sizeof(dp->key) % 6); + for (buf = (uint64_t *)&dp->key; + !res.a0 && (u8 *)buf - (u8 *)&dp->key < sizeof(dp->key); buf += 6) arm_smccc_smc(RK_SIP_HDCP_KEY_DATA64, buf[0], buf[1], buf[2], buf[3], buf[4], buf[5], 0, &res); diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.h b/drivers/gpu/drm/rockchip/cdn-dp-core.h index 8b5d283c66c6..22f059268afe 100644 --- a/drivers/gpu/drm/rockchip/cdn-dp-core.h +++ b/drivers/gpu/drm/rockchip/cdn-dp-core.h @@ -80,6 +80,9 @@ enum { CDN_DP_HDCP_KEY_LEN = 308, }; +/* + * Size must be divisible by 6 + */ struct cdn_dp_hdcp_key_1x { u8 ksv[CDN_DP_HDCP_KSV_LEN]; u8 device_key[CDN_DP_HDCP_DPK_LEN];