This is a note to let you know that I've just added the patch titled
drm/i915/dsi: defend gpio table against out of bounds access
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
drm-i915-dsi-defend-gpio-table-against-out-of-bounds-access.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 4db3a2448ec8902310acb78de39b6227a9a56ac8 Mon Sep 17 00:00:00 2001
From: Jani Nikula <jani.nikula@xxxxxxxxx>
Date: Thu, 4 Feb 2016 12:50:49 +0200
Subject: drm/i915/dsi: defend gpio table against out of bounds access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: Jani Nikula <jani.nikula@xxxxxxxxx>
commit 4db3a2448ec8902310acb78de39b6227a9a56ac8 upstream.
Do not blindly trust the VBT data used for indexing.
Reviewed-by: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
Signed-off-by: Jani Nikula <jani.nikula@xxxxxxxxx>
Link: http://patchwork.freedesktop.org/patch/msgid/cc32d40c2b47f2d2151811855ac2c3dabab1d57d.1454582914.git.jani.nikula@xxxxxxxxx
(cherry picked from commit 5d2d0a12d3d08bf50434f0b5947bb73bac04b941)
Signed-off-by: Jani Nikula <jani.nikula@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/gpu/drm/i915/intel_dsi_panel_vbt.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
+++ b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
@@ -209,6 +209,11 @@ static const u8 *mipi_exec_gpio(struct i
/* pull up/down */
action = *data++;
+ if (gpio >= ARRAY_SIZE(gtable)) {
+ DRM_DEBUG_KMS("unknown gpio %u\n", gpio);
+ goto out;
+ }
+
function = gtable[gpio].function_reg;
pad = gtable[gpio].pad_reg;
@@ -226,6 +231,7 @@ static const u8 *mipi_exec_gpio(struct i
vlv_gpio_nc_write(dev_priv, pad, val);
mutex_unlock(&dev_priv->sb_lock);
+out:
return data;
}
Patches currently in stable-queue which might be from jani.nikula@xxxxxxxxx are
queue-4.4/drm-i915-dp-fall-back-to-18-bpp-when-sink-capability-is-unknown.patch
queue-4.4/drm-i915-init-power-domains-early-in-driver-load.patch
queue-4.4/drm-i915-don-t-reject-primary-plane-windowing-with-color-keying-enabled-on-skl.patch
queue-4.4/drm-i915-dsi-don-t-pass-arbitrary-data-to-sideband.patch
queue-4.4/drm-i915-fix-error-path-in-intel_setup_gmbus.patch
queue-4.4/drm-i915-make-sure-dc-writes-are-coherent-on-flush.patch
queue-4.4/drm-i915-dsi-defend-gpio-table-against-out-of-bounds-access.patch
queue-4.4/drm-i915-skl-don-t-skip-mst-encoders-in-skl_ddi_pll_select.patch
queue-4.4/drm-i915-restore-inhibiting-the-load-of-the-default-context.patch
queue-4.4/drm-i915-intel_hpd_init-fix-suspend-resume-reprobing.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html