Re: [PATCH v8 07/21] drm/bridge: synopsys: dw-dp: Fix support for short I2C reads

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Buffer overflow and integer underflow due to missing bounds check on DP AUX read length.
--

--- Patch [7]: [PATCH v8 07/21] drm/bridge: synopsys: dw-dp: Fix support for short I2C reads ---
commit db106fc9593a19fc4e0e7028df22f1cecf9e1c41
Author: Sebastian Reichel <[email protected]>

drm/bridge: synopsys: dw-dp: Fix support for short I2C reads

This commit modifies dw_dp_aux_transfer to support short I2C reads by
returning the data received rather than returning -EBUSY when the read
count doesn't exactly match the requested size.

> diff --git a/drivers/gpu/drm/bridge/synopsys/dw-dp.c b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> --- a/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> +++ b/drivers/gpu/drm/bridge/synopsys/dw-dp.c
> @@ -1513,7 +1513,7 @@ static ssize_t dw_dp_aux_transfer(struct drm_dp_aux *aux,
>  		if (msg->request & DP_AUX_I2C_READ) {
>  			size_t count = FIELD_GET(AUX_BYTES_READ, value) - 1;
>  
> -			if (count != msg->size)
> +			if (!count)
>  				return -EBUSY;
>  
>  			ret = dw_dp_aux_read_data(dp, msg->buffer, count);

[Severity: High]
Does this code adequately protect msg->buffer from overflow if the hardware
reports a count greater than msg->size?

By removing the exact length match check, an anomalous DisplayPort sink might
return an AUX_BYTES_READ value resulting in count > msg->size. This unverified
count would then be passed to dw_dp_aux_read_data(), which could write past
the bounds of msg->buffer.

Additionally, if the hardware reports an AUX_BYTES_READ of 0, could count
underflow to SIZE_MAX? Since SIZE_MAX is non-zero, it would bypass the !count
check, potentially causing dw_dp_aux_read_data() to attempt an excessively
large read and write operation.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260731-synopsys-dw-dp-improvements-v8-0-ac1e6a75782f@collabora.com?part=7