From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 10:39:17 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v6.1.179~80 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=28e665a23022a5482a13852399a955571a4c03b1;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch --- diff --git a/queue-6.1/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch b/queue-6.1/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch new file mode 100644 index 0000000000..fca4282f68 --- /dev/null +++ b/queue-6.1/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch @@ -0,0 +1,67 @@ +From 55bd5e685bda455b9b50c835f8c8442d52a344a3 Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Fri, 10 Apr 2026 04:19:01 +0000 +Subject: drm/dp/mst: fix buffer overflows in sideband chunk accumulation + +From: Ashutosh Desai + +commit 55bd5e685bda455b9b50c835f8c8442d52a344a3 upstream. + +drm_dp_sideband_append_payload() has three related bugs when processing +device-provided sideband reply data: + +1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken + directly from the DP sideband header. If a device sends msg_len=0, + curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len) + is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow). + drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy() + writes 255 bytes into msg[], both far out of bounds. + +2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is + only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks + until curchunk_idx reaches curchunk_len, writing up to 15 bytes past + the end of chunk[] into msg[]. + +3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to + msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256], + so the memcpy can spill into adjacent struct fields. + +All three are reachable from any DP MST device that can forge sideband +reply messages on a physical connection. + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Cc: # v3.17+ +Signed-off-by: Ashutosh Desai +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patch.msgid.link/20260410041901.2438960-1-ashutoshdesai993@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -779,6 +779,12 @@ static bool drm_dp_sideband_append_paylo + { + u8 crc4; + ++ /* curchunk_len must be >= 1 (min 1 CRC byte) and fit in chunk[] */ ++ if (!msg->curchunk_len || ++ msg->curchunk_len > ARRAY_SIZE(msg->chunk) || ++ msg->curchunk_idx + replybuflen > ARRAY_SIZE(msg->chunk)) ++ return false; ++ + memcpy(&msg->chunk[msg->curchunk_idx], replybuf, replybuflen); + msg->curchunk_idx += replybuflen; + +@@ -789,6 +795,9 @@ static bool drm_dp_sideband_append_paylo + print_hex_dump(KERN_DEBUG, "wrong crc", + DUMP_PREFIX_NONE, 16, 1, + msg->chunk, msg->curchunk_len, false); ++ /* Guard against accumulated msg[] overflow */ ++ if (msg->curlen + msg->curchunk_len - 1 > ARRAY_SIZE(msg->msg)) ++ return false; + /* copy chunk into bigger msg */ + memcpy(&msg->msg[msg->curlen], msg->chunk, msg->curchunk_len - 1); + msg->curlen += msg->curchunk_len - 1; diff --git a/queue-6.1/drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch b/queue-6.1/drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch new file mode 100644 index 0000000000..db93166142 --- /dev/null +++ b/queue-6.1/drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch @@ -0,0 +1,61 @@ +From 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Sun, 10 May 2026 20:17:33 +0000 +Subject: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers + +From: Ashutosh Desai + +commit 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 upstream. + +drm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw +message and then unconditionally does: + + memcpy(bytes, &raw->msg[idx], num_bytes); + +without checking that idx + num_bytes <= raw->curlen. raw->msg[] is +256 bytes; if a malicious or misbehaving MST hub sets num_bytes larger +than the remaining payload, the memcpy reads past the received data +into whatever follows in raw->msg[]. + +drm_dp_sideband_parse_remote_i2c_read_ack() has the same flaw (noted +with a /* TODO check */ comment since the code was introduced). + +Fix both functions by using a single combined check +(idx + num_bytes > curlen) before each memcpy. Since num_bytes is u8, +it is always >= 0, so this strictly subsumes the simpler idx > curlen +form and no separate step is needed. + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Cc: # v3.17+ +Signed-off-by: Ashutosh Desai +Reviewed-by: Lyude Paul +[added missing fixes tag] +Signed-off-by: Lyude Paul +Link: https://patch.msgid.link/20260510201733.2882224-1-ashutoshdesai993@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -861,7 +861,7 @@ static bool drm_dp_sideband_parse_remote + goto fail_len; + repmsg->u.remote_dpcd_read_ack.num_bytes = raw->msg[idx]; + idx++; +- if (idx > raw->curlen) ++ if (idx + repmsg->u.remote_dpcd_read_ack.num_bytes > raw->curlen) + goto fail_len; + + memcpy(repmsg->u.remote_dpcd_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_dpcd_read_ack.num_bytes); +@@ -897,7 +897,9 @@ static bool drm_dp_sideband_parse_remote + goto fail_len; + repmsg->u.remote_i2c_read_ack.num_bytes = raw->msg[idx]; + idx++; +- /* TODO check */ ++ if (idx + repmsg->u.remote_i2c_read_ack.num_bytes > raw->curlen) ++ goto fail_len; ++ + memcpy(repmsg->u.remote_i2c_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_i2c_read_ack.num_bytes); + return true; + fail_len: diff --git a/queue-6.1/drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch b/queue-6.1/drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch new file mode 100644 index 0000000000..6f590d016f --- /dev/null +++ b/queue-6.1/drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch @@ -0,0 +1,90 @@ +From 6b89ba3dba2f583626fb693e47e951ffb8bf591f Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Sun, 10 May 2026 20:31:28 +0000 +Subject: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers + +From: Ashutosh Desai + +commit 6b89ba3dba2f583626fb693e47e951ffb8bf591f upstream. + +Three sideband reply parsers read 16-bit fields as: + + val = (raw->msg[idx] << 8) | (raw->msg[idx+1]); + +and check bounds only after the fact. When idx == raw->curlen, +raw->msg[idx+1] reads one byte past the received message data into +the following struct fields (curchunk_len, curchunk_idx, curlen). + +Affected functions: + - drm_dp_sideband_parse_enum_path_resources_ack() + full_payload_bw_number and avail_payload_bw_number fields + - drm_dp_sideband_parse_allocate_payload_ack() + allocated_pbn field + - drm_dp_sideband_parse_query_payload_ack() + allocated_pbn field + +Fix by using a single combined check (idx + 2 > curlen) before each +2-byte read. Since the check is strictly tighter than idx > curlen, +no separate step is needed. + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Cc: # v3.17+ +Signed-off-by: Ashutosh Desai +Reviewed-by: Lyude Paul +[added fixes tag] +Signed-off-by: Lyude Paul +Link: https://patch.msgid.link/20260510203128.2884846-1-ashutoshdesai993@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 17 ++++------------- + 1 file changed, 4 insertions(+), 13 deletions(-) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -924,16 +924,13 @@ static bool drm_dp_sideband_parse_enum_p + repmsg->u.path_resources.port_number = (raw->msg[idx] >> 4) & 0xf; + repmsg->u.path_resources.fec_capable = raw->msg[idx] & 0x1; + idx++; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.path_resources.full_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]); + idx += 2; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.path_resources.avail_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]); +- idx += 2; +- if (idx > raw->curlen) +- goto fail_len; + return true; + fail_len: + DRM_DEBUG_KMS("enum resource parse length fail %d %d\n", idx, raw->curlen); +@@ -951,12 +948,9 @@ static bool drm_dp_sideband_parse_alloca + goto fail_len; + repmsg->u.allocate_payload.vcpi = raw->msg[idx]; + idx++; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.allocate_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx+1]); +- idx += 2; +- if (idx > raw->curlen) +- goto fail_len; + return true; + fail_len: + DRM_DEBUG_KMS("allocate payload parse length fail %d %d\n", idx, raw->curlen); +@@ -970,12 +964,9 @@ static bool drm_dp_sideband_parse_query_ + + repmsg->u.query_payload.port_number = (raw->msg[idx] >> 4) & 0xf; + idx++; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.query_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx + 1]); +- idx += 2; +- if (idx > raw->curlen) +- goto fail_len; + return true; + fail_len: + DRM_DEBUG_KMS("query payload parse length fail %d %d\n", idx, raw->curlen); diff --git a/queue-6.1/drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch b/queue-6.1/drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch new file mode 100644 index 0000000000..09f6345311 --- /dev/null +++ b/queue-6.1/drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch @@ -0,0 +1,38 @@ +From 46c31e1604d121221167cb09380de8c7d53290b9 Mon Sep 17 00:00:00 2001 +From: Sergey Shtylyov +Date: Fri, 30 Jan 2026 23:35:42 +0300 +Subject: drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() + +From: Sergey Shtylyov + +commit 46c31e1604d121221167cb09380de8c7d53290b9 upstream. + +The result of cdn_dp_reg_write() is checked everywhere (with the error +being logged by the callers) except one place in cdn_dp_config_video(). +Add the missing result check, bailing out early on error... + +Found by Linux Verification Center (linuxtesting.org) with the Svace static +analysis tool. + +Fixes: 1a0f7ed3abe2 ("drm/rockchip: cdn-dp: add cdn DP support for rk3399") +Signed-off-by: Sergey Shtylyov +Cc: stable@vger.kernel.org +Reviewed-by: Chaoyi Chen +Signed-off-by: Heiko Stuebner +Link: https://patch.msgid.link/adf6b313-f7db-4d8f-9000-8c65446ba041@auroraos.dev +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c ++++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c +@@ -683,6 +683,8 @@ int cdn_dp_config_video(struct cdn_dp_de + val = div_u64(8 * (symbol + 1), bit_per_pix) - val; + val += 2; + ret = cdn_dp_reg_write(dp, DP_VC_TABLE(15), val); ++ if (ret) ++ goto err_config_video; + + switch (video->color_depth) { + case 6: diff --git a/queue-6.1/series b/queue-6.1/series index 362569fac8..e17eae78ee 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -167,3 +167,7 @@ net-mlx5e-report-zero-bandwidth-for-non-ets-traffic-.patch net-mlx5e-reject-unsupported-cb-shaper-tsa-in-ets-va.patch net-ipv6-fix-dif-and-sdif-mismatch-in-raw6_icmp_erro.patch bpf-sockmap-fix-cork-use-after-free-in-tcp_bpf_sendm.patch +drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch +drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch +drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch +drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch