1.5 KiB
CVE-2024-26721
Description
In the Linux kernel, the following vulnerability has been resolved:drm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg addressCommit bd077259d0a9 ("drm/i915/vdsc: Add function to read any PPSregister") defines a new macro to calculate the DSC PPS registeraddresses with PPS number as an input. This macro correctly calculatesthe addresses till PPS 11 since the addresses increment by 4. So in thatcase the following macro works correctly to give correct registeraddress:_MMIO(_DSCA_PPS_0 + (pps) * 4)However after PPS 11, the register address for PPS 12 increments by 12because of RC Buffer memory allocation in between. Because of thisdiscontinuity in the address space, the macro calculates wrong addressesfor PPS 12 - 16 resulting into incorrect DSC PPS parameter valueread/writes causing DSC corruption.This fixes it by correcting this macro to add the offset of 12 for PPS>=12.v3: Add correct paranthesis for pps argument (Jani Nikula)(cherry picked from commit 6074be620c31dc2ae11af96a1a5ea95580976fb5)
POC
Reference
No PoCs from references.