From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 8 Apr 2025 06:49:24 +0000 (+0200)
Subject: 6.6-stable patches
X-Git-Tag: v5.4.292~62
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b3ba96e28a4db198d2ed241b2dc21454818c4bb6;p=thirdparty%2Fkernel%2Fstable-queue.git

6.6-stable patches

added patches:
	drm-amd-display-check-link_index-before-accessing-dc-links.patch
---

diff --git a/queue-6.6/drm-amd-display-check-link_index-before-accessing-dc-links.patch b/queue-6.6/drm-amd-display-check-link_index-before-accessing-dc-links.patch
new file mode 100644
index 0000000000..e36daf37e6
--- /dev/null
+++ b/queue-6.6/drm-amd-display-check-link_index-before-accessing-dc-links.patch
@@ -0,0 +1,42 @@
+From 8aa2864044b9d13e95fe224f32e808afbf79ecdf Mon Sep 17 00:00:00 2001
+From: Alex Hung <alex.hung@amd.com>
+Date: Tue, 16 Apr 2024 16:30:17 -0600
+Subject: drm/amd/display: Check link_index before accessing dc->links[]
+
+From: Alex Hung <alex.hung@amd.com>
+
+commit 8aa2864044b9d13e95fe224f32e808afbf79ecdf upstream.
+
+[WHY & HOW]
+dc->links[] has max size of MAX_LINKS and NULL is return when trying to
+access with out-of-bound index.
+
+This fixes 3 OVERRUN and 1 RESOURCE_LEAK issues reported by Coverity.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+[The macro MAX_LINKS is introduced by Commit 60df5628144b ("drm/amd/display:
+ handle invalid connector indices") after 6.10. So here we still use the
+ original array length MAX_PIPES * 2]
+Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_exports.c
+@@ -37,6 +37,9 @@
+ #include "dce/dce_i2c.h"
+ struct dc_link *dc_get_link_at_index(struct dc *dc, uint32_t link_index)
+ {
++	if (link_index >= (MAX_PIPES * 2))
++		return NULL;
++
+ 	return dc->links[link_index];
+ }
+ 
diff --git a/queue-6.6/series b/queue-6.6/series
index a6bc43b2c9..ebe1d51687 100644
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -226,3 +226,4 @@ tracing-switch-trace_events_hist.c-code-over-to-use-.patch
 tracing-hist-add-poll-pollin-support-on-hist-file.patch
 tracing-hist-support-pollpri-event-for-poll-on-histo.patch
 tracing-correct-the-refcount-if-the-hist-hist_debug-.patch
+drm-amd-display-check-link_index-before-accessing-dc-links.patch