6.6-stable patches

added patches:
	drm-amd-display-check-link_index-before-accessing-dc-links.patch

diff --git a/queue-6.6/drm-amd-display-check-link_index-before-accessing-dc-links.patch b/queue-6.6/drm-amd-display-check-link_index-before-accessing-dc-links.patch
new file mode 100644 (file)
index 0000000..e36daf3
--- /dev/null
+++ b/queue-6.6/drm-amd-display-check-link_index-before-accessing-dc-links.patch
@@ -0,0 +1,42 @@
+From 8aa2864044b9d13e95fe224f32e808afbf79ecdf Mon Sep 17 00:00:00 2001
+From: Alex Hung <alex.hung@amd.com>
+Date: Tue, 16 Apr 2024 16:30:17 -0600
+Subject: drm/amd/display: Check link_index before accessing dc->links[]
+
+From: Alex Hung <alex.hung@amd.com>
+
+commit 8aa2864044b9d13e95fe224f32e808afbf79ecdf upstream.
+
+[WHY & HOW]
+dc->links[] has max size of MAX_LINKS and NULL is return when trying to
+access with out-of-bound index.
+
+This fixes 3 OVERRUN and 1 RESOURCE_LEAK issues reported by Coverity.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+[The macro MAX_LINKS is introduced by Commit 60df5628144b ("drm/amd/display:
+ handle invalid connector indices") after 6.10. So here we still use the
+ original array length MAX_PIPES * 2]
+Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c
+@@ -37,6 +37,9 @@
+ #include "dce/dce_i2c.h"
+ struct dc_link *dc_get_link_at_index(struct dc *dc, uint32_t link_index)
+ {
++      if (link_index >= (MAX_PIPES * 2))
++              return NULL;
++
+       return dc->links[link_index];
+ }
+ 

diff --git a/queue-6.6/series b/queue-6.6/series
index a6bc43b2c9842ebbf796c57330b984a90cbf1a8f..ebe1d51687cd5909b8adfbf9d1cabe8752fada3a 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -226,3 +226,4 @@ tracing-switch-trace_events_hist.c-code-over-to-use-.patch
 tracing-hist-add-poll-pollin-support-on-hist-file.patch
 tracing-hist-support-pollpri-event-for-poll-on-histo.patch
 tracing-correct-the-refcount-if-the-hist-hist_debug-.patch
+drm-amd-display-check-link_index-before-accessing-dc-links.patch