From 040c82312768422360239982b2a667f15a8e6a38 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 31 Oct 2022 07:39:16 +0100 Subject: [PATCH] 5.4-stable patches added patches: drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch --- ...ory-corruption-with-too-many-bridges.patch | 42 +++++++++++++++++++ ...ory-corruption-with-too-many-bridges.patch | 41 ++++++++++++++++++ queue-5.4/series | 2 + 3 files changed, 85 insertions(+) create mode 100644 queue-5.4/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch create mode 100644 queue-5.4/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch diff --git a/queue-5.4/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch b/queue-5.4/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch new file mode 100644 index 00000000000..ba761dbce44 --- /dev/null +++ b/queue-5.4/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch @@ -0,0 +1,42 @@ +From 2e786eb2f9cebb07e317226b60054df510b60c65 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:13 +0200 +Subject: drm/msm/dsi: fix memory corruption with too many bridges + +From: Johan Hovold + +commit 2e786eb2f9cebb07e317226b60054df510b60c65 upstream. + +Add the missing sanity check on the bridge counter to avoid corrupting +data beyond the fixed-sized bridge array in case there are ever more +than eight bridges. + +Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support") +Cc: stable@vger.kernel.org # 4.1 +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/502668/ +Link: https://lore.kernel.org/r/20220913085320.8577-4-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dsi/dsi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/msm/dsi/dsi.c ++++ b/drivers/gpu/drm/msm/dsi/dsi.c +@@ -203,6 +203,12 @@ int msm_dsi_modeset_init(struct msm_dsi + return -EINVAL; + + priv = dev->dev_private; ++ ++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { ++ DRM_DEV_ERROR(dev->dev, "too many bridges\n"); ++ return -ENOSPC; ++ } ++ + msm_dsi->dev = dev; + + ret = msm_dsi_host_modeset_init(msm_dsi->host, dev); diff --git a/queue-5.4/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch b/queue-5.4/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch new file mode 100644 index 00000000000..d89d8b5e1c5 --- /dev/null +++ b/queue-5.4/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch @@ -0,0 +1,41 @@ +From 4c1294da6aed1f16d47a417dcfe6602833c3c95c Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:14 +0200 +Subject: drm/msm/hdmi: fix memory corruption with too many bridges + +From: Johan Hovold + +commit 4c1294da6aed1f16d47a417dcfe6602833c3c95c upstream. + +Add the missing sanity check on the bridge counter to avoid corrupting +data beyond the fixed-sized bridge array in case there are ever more +than eight bridges. + +Fixes: a3376e3ec81c ("drm/msm: convert to drm_bridge") +Cc: stable@vger.kernel.org # 3.12 +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/502670/ +Link: https://lore.kernel.org/r/20220913085320.8577-5-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -293,6 +293,11 @@ int msm_hdmi_modeset_init(struct hdmi *h + struct platform_device *pdev = hdmi->pdev; + int ret; + ++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { ++ DRM_DEV_ERROR(dev->dev, "too many bridges\n"); ++ return -ENOSPC; ++ } ++ + hdmi->dev = dev; + hdmi->encoder = encoder; + diff --git a/queue-5.4/series b/queue-5.4/series index 06b7d982137..3d9ae728b8c 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -13,3 +13,5 @@ tools-iio-iio_utils-fix-digit-calculation.patch iio-light-tsl2583-fix-module-unloading.patch fbdev-smscufx-fix-several-use-after-free-bugs.patch mac802154-fix-lqi-recording.patch +drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch +drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch -- 2.47.3