This is a note to let you know that I've just added the patch titled
drm/amdgpu: avoid a possible array overflow
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
drm-amdgpu-avoid-a-possible-array-overflow.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From e1718d97aa88ea44a6a8f50ff464253dd0dacf01 Mon Sep 17 00:00:00 2001
From: Alex Deucher <alexander.deucher@xxxxxxx>
Date: Wed, 24 Aug 2016 12:31:36 -0400
Subject: drm/amdgpu: avoid a possible array overflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: Alex Deucher <alexander.deucher@xxxxxxx>
commit e1718d97aa88ea44a6a8f50ff464253dd0dacf01 upstream.
When looking up the connector type make sure the index
is valid. Avoids a later crash if we read past the end
of the array.
Workaround for bug:
https://bugs.freedesktop.org/show_bug.cgi?id=97460
Reviewed-by: Christian König <christian.koenig@xxxxxxx>
Signed-off-by: Alex Deucher <alexander.deucher@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
@@ -331,6 +331,12 @@ bool amdgpu_atombios_get_connector_info_
(le16_to_cpu(path->usConnObjectId) &
OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
+ if (con_obj_id >= ARRAY_SIZE(object_connector_convert)) {
+ DRM_ERROR("invalid con_obj_id %d for device tag 0x%04x\n",
+ con_obj_id, le16_to_cpu(path->usDeviceTag));
+ continue;
+ }
+
connector_type =
object_connector_convert[con_obj_id];
connector_object_id = con_obj_id;
Patches currently in stable-queue which might be from alexander.deucher@xxxxxxx are
queue-4.4/drm-amd-amdgpu-sdma-resume-fail-during-s4-on-ci.patch
queue-4.4/drm-amdgpu-change-gart-offset-to-64-bit.patch
queue-4.4/drm-amdgpu-avoid-a-possible-array-overflow.patch
queue-4.4/drm-amdgpu-record-error-code-when-ring-test-failed.patch
queue-4.4/drm-amdgpu-skip-tv-cv-in-display-parsing.patch
queue-4.4/drm-amdgpu-fix-amdgpu_move_blit-on-32bit-systems.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html