Patch "drm/displayid: add displayid_get_header() and check bounds better" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    drm/displayid: add displayid_get_header() and check bounds better

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-displayid-add-displayid_get_header-and-check-bou.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f59dd771314e3d885d6c06bcab7983636ed24b6f
Author: Jani Nikula <jani.nikula@xxxxxxxxx>
Date:   Thu Feb 16 22:44:58 2023 +0200

    drm/displayid: add displayid_get_header() and check bounds better
    
    [ Upstream commit 5bacecc3c56131c31f18b23d366f2184328fd9cf ]
    
    Add a helper to get a pointer to struct displayid_header. To be
    pedantic, add buffer overflow checks to not touch the base if that
    itself would overflow.
    
    Cc: Iaroslav Boliukin <iam@xxxxxxx>
    Cc: Dmitry Osipenko <dmitry.osipenko@xxxxxxxxxxxxx>
    Signed-off-by: Jani Nikula <jani.nikula@xxxxxxxxx>
    Tested-by: Dmitry Osipenko <dmitry.osipenko@xxxxxxxxxxxxx>
    Reviewed-by: Dmitry Osipenko <dmitry.osipenko@xxxxxxxxxxxxx>
    Signed-off-by: Dmitry Osipenko <dmitry.osipenko@xxxxxxxxxxxxx>
    Link: https://patchwork.freedesktop.org/patch/msgid/4a03b3a5132642d3cdb6d4c2641422955a917292.1676580180.git.jani.nikula@xxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpu/drm/drm_displayid.c b/drivers/gpu/drm/drm_displayid.c
index 32da557b960fd..82b7f0bb44097 100644
--- a/drivers/gpu/drm/drm_displayid.c
+++ b/drivers/gpu/drm/drm_displayid.c
@@ -7,13 +7,28 @@
 #include <drm/drm_edid.h>
 #include <drm/drm_print.h>
 
+static const struct displayid_header *
+displayid_get_header(const u8 *displayid, int length, int index)
+{
+	const struct displayid_header *base;
+
+	if (sizeof(*base) > length - index)
+		return ERR_PTR(-EINVAL);
+
+	base = (const struct displayid_header *)&displayid[index];
+
+	return base;
+}
+
 static int validate_displayid(const u8 *displayid, int length, int idx)
 {
 	int i, dispid_length;
 	u8 csum = 0;
 	const struct displayid_header *base;
 
-	base = (const struct displayid_header *)&displayid[idx];
+	base = displayid_get_header(displayid, length, idx);
+	if (IS_ERR(base))
+		return PTR_ERR(base);
 
 	DRM_DEBUG_KMS("base revision 0x%x, length %d, %d %d\n",
 		      base->rev, base->bytes, base->prod_id, base->ext_count);