6.6-stable patches

added patches:
	drm-i915-hdcp-check-streams-bounds-before-overflow.patch

diff --git a/queue-6.6/drm-i915-hdcp-check-streams-bounds-before-overflow.patch b/queue-6.6/drm-i915-hdcp-check-streams-bounds-before-overflow.patch
new file mode 100644 (file)
index 0000000..f71dbc3
--- /dev/null
+++ b/queue-6.6/drm-i915-hdcp-check-streams-bounds-before-overflow.patch
@@ -0,0 +1,59 @@
+From stable+bounces-294871-greg=kroah.com@vger.kernel.org Mon Aug  3 22:28:29 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon,  3 Aug 2026 16:26:58 -0400
+Subject: drm/i915/hdcp: check streams[] bounds before overflow
+To: stable@vger.kernel.org
+Cc: Jani Nikula <jani.nikula@intel.com>, Martin Hodo <martin.hodo@intel.com>, Anshuman Gupta <anshuman.gupta@intel.com>, Suraj Kandpal <suraj.kandpal@intel.com>, Joonas Lahtinen <joonas.lahtinen@linux.intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260803202658.1647132-4-sashal@kernel.org>
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+[ Upstream commit bbb15a6b042d02e5508a02b4847e02d2579ee7bc ]
+
+The data->streams[] overflow check is done after the buffer overflow has
+already happened. Move the overflow check before the write.
+
+Side note, emitting a warning splat with a backtrace might be overkill
+here, but prefer not changing the behaviour other than not doing the
+overrun.
+
+Discovered using AI-assisted static analysis confirmed by Intel Product
+Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: e03187e12cae ("drm/i915/hdcp: MST streams support in hdcp port_data")
+Cc: stable@vger.kernel.org # v5.12+
+Cc: Anshuman Gupta <anshuman.gupta@intel.com>
+Cc: Suraj Kandpal <suraj.kandpal@intel.com>
+Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
+Link: https://patch.msgid.link/20260625170304.1104723-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_hdcp.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_hdcp.c
++++ b/drivers/gpu/drm/i915/display/intel_hdcp.c
+@@ -2321,6 +2321,9 @@ intel_hdcp_set_streams(struct intel_digi
+               if (conn_dig_port != dig_port)
+                       continue;
+ 
++              if (drm_WARN_ON(&i915->drm, data->k >= INTEL_NUM_PIPES(i915)))
++                      return -EINVAL;
++
+               data->streams[data->k].stream_id =
+                       intel_conn_to_vcpi(&state->base, connector);
+               data->k++;
+@@ -2331,7 +2334,7 @@ intel_hdcp_set_streams(struct intel_digi
+       }
+       drm_connector_list_iter_end(&conn_iter);
+ 
+-      if (drm_WARN_ON(&i915->drm, data->k > INTEL_NUM_PIPES(i915) || data->k == 0))
++      if (drm_WARN_ON(&i915->drm, !data->k))
+               return -EINVAL;
+ 
+       return 0;

diff --git a/queue-6.6/series b/queue-6.6/series
index 63087e5627a917a8475b123b1306d301107e29b1..3b4276e4bd0654aa0ab276a95f1f404a1887a0b7 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -255,3 +255,4 @@ drm-i915-fbc-extract-intel_fbc_has_fences.patch
 drm-i915-hdcp-migrate-away-from-kdev_to_i915-in-bind-unbind.patch
 drm-i915-hdcp-move-to-using-intel_display-in-intel_hdcp.patch
 drm-i915-hdcp-require-monotonically-increasing-seq_num_v.patch
+drm-i915-hdcp-check-streams-bounds-before-overflow.patch