From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 7 Aug 2026 13:56:34 +0000 (+0200)
Subject: 6.6-stable patches
X-Git-Tag: v6.6.151~9
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=999ede3eec569285e1261744bef1bb3bffd0e7b2;p=thirdparty%2Fkernel%2Fstable-queue.git

6.6-stable patches

added patches:
	drm-i915-hdcp-check-streams-bounds-before-overflow.patch
---

diff --git a/queue-6.6/drm-i915-hdcp-check-streams-bounds-before-overflow.patch b/queue-6.6/drm-i915-hdcp-check-streams-bounds-before-overflow.patch
new file mode 100644
index 0000000000..f71dbc3b9a
--- /dev/null
+++ b/queue-6.6/drm-i915-hdcp-check-streams-bounds-before-overflow.patch
@@ -0,0 +1,59 @@
+From stable+bounces-294871-greg=kroah.com@vger.kernel.org Mon Aug  3 22:28:29 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon,  3 Aug 2026 16:26:58 -0400
+Subject: drm/i915/hdcp: check streams[] bounds before overflow
+To: stable@vger.kernel.org
+Cc: Jani Nikula <jani.nikula@intel.com>, Martin Hodo <martin.hodo@intel.com>, Anshuman Gupta <anshuman.gupta@intel.com>, Suraj Kandpal <suraj.kandpal@intel.com>, Joonas Lahtinen <joonas.lahtinen@linux.intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260803202658.1647132-4-sashal@kernel.org>
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+[ Upstream commit bbb15a6b042d02e5508a02b4847e02d2579ee7bc ]
+
+The data->streams[] overflow check is done after the buffer overflow has
+already happened. Move the overflow check before the write.
+
+Side note, emitting a warning splat with a backtrace might be overkill
+here, but prefer not changing the behaviour other than not doing the
+overrun.
+
+Discovered using AI-assisted static analysis confirmed by Intel Product
+Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: e03187e12cae ("drm/i915/hdcp: MST streams support in hdcp port_data")
+Cc: stable@vger.kernel.org # v5.12+
+Cc: Anshuman Gupta <anshuman.gupta@intel.com>
+Cc: Suraj Kandpal <suraj.kandpal@intel.com>
+Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
+Link: https://patch.msgid.link/20260625170304.1104723-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_hdcp.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_hdcp.c
++++ b/drivers/gpu/drm/i915/display/intel_hdcp.c
+@@ -2321,6 +2321,9 @@ intel_hdcp_set_streams(struct intel_digi
+ 		if (conn_dig_port != dig_port)
+ 			continue;
+ 
++		if (drm_WARN_ON(&i915->drm, data->k >= INTEL_NUM_PIPES(i915)))
++			return -EINVAL;
++
+ 		data->streams[data->k].stream_id =
+ 			intel_conn_to_vcpi(&state->base, connector);
+ 		data->k++;
+@@ -2331,7 +2334,7 @@ intel_hdcp_set_streams(struct intel_digi
+ 	}
+ 	drm_connector_list_iter_end(&conn_iter);
+ 
+-	if (drm_WARN_ON(&i915->drm, data->k > INTEL_NUM_PIPES(i915) || data->k == 0))
++	if (drm_WARN_ON(&i915->drm, !data->k))
+ 		return -EINVAL;
+ 
+ 	return 0;
diff --git a/queue-6.6/series b/queue-6.6/series
index 63087e5627..3b4276e4bd 100644
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -255,3 +255,4 @@ drm-i915-fbc-extract-intel_fbc_has_fences.patch
 drm-i915-hdcp-migrate-away-from-kdev_to_i915-in-bind-unbind.patch
 drm-i915-hdcp-move-to-using-intel_display-in-intel_hdcp.patch
 drm-i915-hdcp-require-monotonically-increasing-seq_num_v.patch
+drm-i915-hdcp-check-streams-bounds-before-overflow.patch