From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail177-1.suw61.mandrillapp.com ([198.2.177.1]:49691 "EHLO mail177-1.suw61.mandrillapp.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753121AbcCAUga convert rfc822-to-8bit (ORCPT ); Tue, 1 Mar 2016 15:36:30 -0500 Received: from pmta06.mandrill.prod.suw01.rsglab.com (127.0.0.1) by mail177-1.suw61.mandrillapp.com id hqnuks22rtko for ; Tue, 1 Mar 2016 20:36:27 +0000 (envelope-from ) From: Subject: Patch "drm/i915/dsi: defend gpio table against out of bounds access" has been added to the 4.4-stable tree To: , , Cc: , Message-Id: <1456864585222107@kroah.com> Date: Tue, 01 Mar 2016 20:36:27 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8BIT Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled drm/i915/dsi: defend gpio table against out of bounds access to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: drm-i915-dsi-defend-gpio-table-against-out-of-bounds-access.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 4db3a2448ec8902310acb78de39b6227a9a56ac8 Mon Sep 17 00:00:00 2001 From: Jani Nikula Date: Thu, 4 Feb 2016 12:50:49 +0200 Subject: drm/i915/dsi: defend gpio table against out of bounds access MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Jani Nikula commit 4db3a2448ec8902310acb78de39b6227a9a56ac8 upstream. Do not blindly trust the VBT data used for indexing. Reviewed-by: Ville Syrjälä Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/cc32d40c2b47f2d2151811855ac2c3dabab1d57d.1454582914.git.jani.nikula@intel.com (cherry picked from commit 5d2d0a12d3d08bf50434f0b5947bb73bac04b941) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/intel_dsi_panel_vbt.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c +++ b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c @@ -209,6 +209,11 @@ static const u8 *mipi_exec_gpio(struct i /* pull up/down */ action = *data++; + if (gpio >= ARRAY_SIZE(gtable)) { + DRM_DEBUG_KMS("unknown gpio %u\n", gpio); + goto out; + } + function = gtable[gpio].function_reg; pad = gtable[gpio].pad_reg; @@ -226,6 +231,7 @@ static const u8 *mipi_exec_gpio(struct i vlv_gpio_nc_write(dev_priv, pad, val); mutex_unlock(&dev_priv->sb_lock); +out: return data; } Patches currently in stable-queue which might be from jani.nikula@intel.com are queue-4.4/drm-i915-dp-fall-back-to-18-bpp-when-sink-capability-is-unknown.patch queue-4.4/drm-i915-init-power-domains-early-in-driver-load.patch queue-4.4/drm-i915-don-t-reject-primary-plane-windowing-with-color-keying-enabled-on-skl.patch queue-4.4/drm-i915-dsi-don-t-pass-arbitrary-data-to-sideband.patch queue-4.4/drm-i915-fix-error-path-in-intel_setup_gmbus.patch queue-4.4/drm-i915-make-sure-dc-writes-are-coherent-on-flush.patch queue-4.4/drm-i915-dsi-defend-gpio-table-against-out-of-bounds-access.patch queue-4.4/drm-i915-skl-don-t-skip-mst-encoders-in-skl_ddi_pll_select.patch queue-4.4/drm-i915-restore-inhibiting-the-load-of-the-default-context.patch queue-4.4/drm-i915-intel_hpd_init-fix-suspend-resume-reprobing.patch