From: Greg Kroah-Hartman Date: Mon, 31 Oct 2022 06:39:09 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.19.263~58 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=be71cb056a6a94773ccfdfc63c7f22f4ce41ffff;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch --- diff --git a/queue-4.19/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch b/queue-4.19/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch new file mode 100644 index 00000000000..ebbca31e60f --- /dev/null +++ b/queue-4.19/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch @@ -0,0 +1,42 @@ +From 2e786eb2f9cebb07e317226b60054df510b60c65 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:13 +0200 +Subject: drm/msm/dsi: fix memory corruption with too many bridges + +From: Johan Hovold + +commit 2e786eb2f9cebb07e317226b60054df510b60c65 upstream. + +Add the missing sanity check on the bridge counter to avoid corrupting +data beyond the fixed-sized bridge array in case there are ever more +than eight bridges. + +Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support") +Cc: stable@vger.kernel.org # 4.1 +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/502668/ +Link: https://lore.kernel.org/r/20220913085320.8577-4-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dsi/dsi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/msm/dsi/dsi.c ++++ b/drivers/gpu/drm/msm/dsi/dsi.c +@@ -200,6 +200,12 @@ int msm_dsi_modeset_init(struct msm_dsi + return -EINVAL; + + priv = dev->dev_private; ++ ++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { ++ DRM_DEV_ERROR(dev->dev, "too many bridges\n"); ++ return -ENOSPC; ++ } ++ + msm_dsi->dev = dev; + + ret = msm_dsi_host_modeset_init(msm_dsi->host, dev); diff --git a/queue-4.19/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch b/queue-4.19/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch new file mode 100644 index 00000000000..79397cf4d8b --- /dev/null +++ b/queue-4.19/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch @@ -0,0 +1,41 @@ +From 4c1294da6aed1f16d47a417dcfe6602833c3c95c Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:14 +0200 +Subject: drm/msm/hdmi: fix memory corruption with too many bridges + +From: Johan Hovold + +commit 4c1294da6aed1f16d47a417dcfe6602833c3c95c upstream. + +Add the missing sanity check on the bridge counter to avoid corrupting +data beyond the fixed-sized bridge array in case there are ever more +than eight bridges. + +Fixes: a3376e3ec81c ("drm/msm: convert to drm_bridge") +Cc: stable@vger.kernel.org # 3.12 +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/502670/ +Link: https://lore.kernel.org/r/20220913085320.8577-5-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -299,6 +299,11 @@ int msm_hdmi_modeset_init(struct hdmi *h + struct platform_device *pdev = hdmi->pdev; + int ret; + ++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { ++ DRM_DEV_ERROR(dev->dev, "too many bridges\n"); ++ return -ENOSPC; ++ } ++ + hdmi->dev = dev; + hdmi->encoder = encoder; + diff --git a/queue-4.19/series b/queue-4.19/series index cd2dc5d1fe3..fe39802414e 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -36,3 +36,5 @@ tools-iio-iio_utils-fix-digit-calculation.patch iio-light-tsl2583-fix-module-unloading.patch fbdev-smscufx-fix-several-use-after-free-bugs.patch mac802154-fix-lqi-recording.patch +drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch +drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch