Patch "drm/i915/dsi: defend gpio table against out of bounds access" has been added to the 4.4-stable tree

Patch "drm/i915/dsi: defend gpio table against out of bounds access" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    drm/i915/dsi: defend gpio table against out of bounds access

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-i915-dsi-defend-gpio-table-against-out-of-bounds-access.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 4db3a2448ec8902310acb78de39b6227a9a56ac8 Mon Sep 17 00:00:00 2001
From: Jani Nikula <jani.nikula@intel.com>
Date: Thu, 4 Feb 2016 12:50:49 +0200
Subject: drm/i915/dsi: defend gpio table against out of bounds access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Jani Nikula <jani.nikula@intel.com>

commit 4db3a2448ec8902310acb78de39b6227a9a56ac8 upstream.

Do not blindly trust the VBT data used for indexing.

Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/cc32d40c2b47f2d2151811855ac2c3dabab1d57d.1454582914.git.jani.nikula@intel.com
(cherry picked from commit 5d2d0a12d3d08bf50434f0b5947bb73bac04b941)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/intel_dsi_panel_vbt.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
+++ b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
@@ -209,6 +209,11 @@ static const u8 *mipi_exec_gpio(struct i
 	/* pull up/down */
 	action = *data++;
 
+	if (gpio >= ARRAY_SIZE(gtable)) {
+		DRM_DEBUG_KMS("unknown gpio %u\n", gpio);
+		goto out;
+	}
+
 	function = gtable[gpio].function_reg;
 	pad = gtable[gpio].pad_reg;
 
@@ -226,6 +231,7 @@ static const u8 *mipi_exec_gpio(struct i
 	vlv_gpio_nc_write(dev_priv, pad, val);
 	mutex_unlock(&dev_priv->sb_lock);
 
+out:
 	return data;
 }
 


Patches currently in stable-queue which might be from jani.nikula@intel.com are

queue-4.4/drm-i915-dp-fall-back-to-18-bpp-when-sink-capability-is-unknown.patch
queue-4.4/drm-i915-init-power-domains-early-in-driver-load.patch
queue-4.4/drm-i915-don-t-reject-primary-plane-windowing-with-color-keying-enabled-on-skl.patch
queue-4.4/drm-i915-dsi-don-t-pass-arbitrary-data-to-sideband.patch
queue-4.4/drm-i915-fix-error-path-in-intel_setup_gmbus.patch
queue-4.4/drm-i915-make-sure-dc-writes-are-coherent-on-flush.patch
queue-4.4/drm-i915-dsi-defend-gpio-table-against-out-of-bounds-access.patch
queue-4.4/drm-i915-skl-don-t-skip-mst-encoders-in-skl_ddi_pll_select.patch
queue-4.4/drm-i915-restore-inhibiting-the-load-of-the-default-context.patch
queue-4.4/drm-i915-intel_hpd_init-fix-suspend-resume-reprobing.patch