firmware AON Buffer Overflow

Vulnerability analysis

The vulnerability stems from unsafe pointer arithmetic in the th1520_aon_power_update function where the code used the RPC_SET_BE16 macro to access the 'mode' field through the 'resource' pointer with a hardcoded offset of 2 bytes. The Smatch static checker flagged this as 'buffer overflow data 2 <= 3', indicating a write beyond the strict bounds of the 'resource' member. In practice, the write lands on the adjacent 'mode' field within the same stack-allocated struct, resulting in a limited two-byte constant write rather than arbitrary memory corruption. The fix replaces the unsafe pointer arithmetic with direct struct member access (msg.resource and msg.mode) and eliminates the custom endianness macros in favor of standard kernel cpu_to_be16() functions. Because the vulnerable code path is triggered through GPU power management and other resource transitions reachable by local users (e.g., via standard DRM device access), exploitation does not require administrative privileges.