ACK: [SRU][N][PATCH 0/1] CVE-2025-21985

[Andrei Gherzan]

On 26/09/09 04:47PM, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-21985
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> drm/amd/display: Fix out-of-bound accesses
> 
> [WHAT & HOW] hpo_stream_to_link_encoder_mapping has size
> MAX_HPO_DP2_ENCODERS(=4), but location can have size up to 6. As a result, it
> is necessary to check location against MAX_HPO_DP2_ENCODERS.
> 
> Similiarly, disp_cfg_stream_location can be used as an array index which should
> be 0..5, so the ASSERT's conditions should be less without equal.
> 
> [ Fix ]
> 
> noble/linux: backported from 8adbb2a98b00
> 
> The upstream fix corrects bounds checks in the AMD display DML2 code so that a
> stream location used as an array index is validated against the actual array
> size before being dereferenced. In this tree the backport dropped the
> dml21_translation_helper.c hunk, since that file is absent from this tree, and
> retained HEAD's is_dp2p0_output_encoder(pipe) logic for the output-encoder
> case because this tree lacks hpo_stream_to_link_encoder_mapping and has no
> out-of-bound access there. The two ASSERT bounds fixes (changing <= to <) in
> dml2_translation_helper.c applied cleanly.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A regression would most likely surface on systems using AMD GPUs with the
> DML2 display pipeline, particularly under DisplayPort 2.0 (DP2) multi-stream
> configurations where the stream location index approaches the array bounds; an
> overly strict bounds check could in theory reject a valid configuration and
> prevent a display from lighting up. Systems without AMD display hardware, and
> AMD systems that do not exercise the DP2 code paths, are not affected by this
> change.
> 
> [ Other Info ]
> 
> Kybele flow-v11-25-ga27c0fa6. Reference: d7bb983f/v1

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260915/41185cc7/attachment.sig>