Linux Kernel DRM/Sun4i DSI Packet Size Underflow Vulnerability

A vulnerability in the Linux kernel's DRM/Sun4i DSI component could lead to a packet size underflow. This issue arises because packet overhead is subtracted using unsigned arithmetic, which can underflow and wrap around to near the maximum value of an unsigned 16-bit integer when a short sync pulse is present. The vulnerability has been addressed by changing the subtraction to signed arithmetic, allowing for proper handling of negative values. The same adjustment was applied to other timing calculations, despite those subtractions being less likely to cause an underflow.

Impact

Exploitation of this vulnerability could lead to incorrect packet size calculations, potentially causing memory corruption or other unintended behavior in the DSI interface.