Add the missing sanity checks on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges.
a3376e3ec81c ("drm/msm: convert to drm_bridge") ab5b0107ccf3 ("drm/msm: Initial add eDP support in msm drm driver (v5)") a689554ba6ed ("drm/msm: Initial add DSI connector support") Fixes: 8a3b4c17f863 ("drm/msm/dp: employ bridge mechanism for display enable and disable") Cc: stable@vger.kernel.org # 3.12 Signed-off-by: Johan Hovold johan+linaro@kernel.org --- drivers/gpu/drm/msm/dp/dp_display.c | 6 ++++++ drivers/gpu/drm/msm/dsi/dsi.c | 6 ++++++ drivers/gpu/drm/msm/hdmi/hdmi.c | 5 +++++ 3 files changed, 17 insertions(+)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c index 3e284fed8d30..fbe950edaefe 100644 --- a/drivers/gpu/drm/msm/dp/dp_display.c +++ b/drivers/gpu/drm/msm/dp/dp_display.c @@ -1604,6 +1604,12 @@ int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev, return -EINVAL;
priv = dev->dev_private; + + if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { + DRM_DEV_ERROR(dev->dev, "too many bridges\n"); + return -ENOSPC; + } + dp_display->drm_dev = dev;
dp_priv = container_of(dp_display, struct dp_display_private, dp_display); diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c index 39bbabb5daf6..8a95c744972a 100644 --- a/drivers/gpu/drm/msm/dsi/dsi.c +++ b/drivers/gpu/drm/msm/dsi/dsi.c @@ -218,6 +218,12 @@ int msm_dsi_modeset_init(struct msm_dsi *msm_dsi, struct drm_device *dev, return -EINVAL;
priv = dev->dev_private; + + if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { + DRM_DEV_ERROR(dev->dev, "too many bridges\n"); + return -ENOSPC; + } + msm_dsi->dev = dev;
ret = msm_dsi_host_modeset_init(msm_dsi->host, dev); diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c index 93fe61b86967..a0ed6aa8e4e1 100644 --- a/drivers/gpu/drm/msm/hdmi/hdmi.c +++ b/drivers/gpu/drm/msm/hdmi/hdmi.c @@ -300,6 +300,11 @@ int msm_hdmi_modeset_init(struct hdmi *hdmi, struct platform_device *pdev = hdmi->pdev; int ret;
+ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { + DRM_DEV_ERROR(dev->dev, "too many bridges\n"); + return -ENOSPC; + } + hdmi->dev = dev; hdmi->encoder = encoder;
On 12/09/2022 18:40, Johan Hovold wrote:
Add the missing sanity checks on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges.
a3376e3ec81c ("drm/msm: convert to drm_bridge") ab5b0107ccf3 ("drm/msm: Initial add eDP support in msm drm driver (v5)") a689554ba6ed ("drm/msm: Initial add DSI connector support")
Most probably you've missed the Fixes: here.
Fixes: 8a3b4c17f863 ("drm/msm/dp: employ bridge mechanism for display enable and disable") Cc: stable@vger.kernel.org # 3.12 Signed-off-by: Johan Hovold johan+linaro@kernel.org
drivers/gpu/drm/msm/dp/dp_display.c | 6 ++++++ drivers/gpu/drm/msm/dsi/dsi.c | 6 ++++++ drivers/gpu/drm/msm/hdmi/hdmi.c | 5 +++++
Could you please split this into respective dp/dsi/hdmi patches. This will assist both the review and the stable team.
Otherwise LGTM.
3 files changed, 17 insertions(+)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c index 3e284fed8d30..fbe950edaefe 100644 --- a/drivers/gpu/drm/msm/dp/dp_display.c +++ b/drivers/gpu/drm/msm/dp/dp_display.c @@ -1604,6 +1604,12 @@ int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev, return -EINVAL; priv = dev->dev_private;
- if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) {
DRM_DEV_ERROR(dev->dev, "too many bridges\n");return -ENOSPC;- }
- dp_display->drm_dev = dev;
dp_priv = container_of(dp_display, struct dp_display_private, dp_display); diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c index 39bbabb5daf6..8a95c744972a 100644 --- a/drivers/gpu/drm/msm/dsi/dsi.c +++ b/drivers/gpu/drm/msm/dsi/dsi.c @@ -218,6 +218,12 @@ int msm_dsi_modeset_init(struct msm_dsi *msm_dsi, struct drm_device *dev, return -EINVAL; priv = dev->dev_private;
- if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) {
DRM_DEV_ERROR(dev->dev, "too many bridges\n");return -ENOSPC;- }
- msm_dsi->dev = dev;
ret = msm_dsi_host_modeset_init(msm_dsi->host, dev); diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c index 93fe61b86967..a0ed6aa8e4e1 100644 --- a/drivers/gpu/drm/msm/hdmi/hdmi.c +++ b/drivers/gpu/drm/msm/hdmi/hdmi.c @@ -300,6 +300,11 @@ int msm_hdmi_modeset_init(struct hdmi *hdmi, struct platform_device *pdev = hdmi->pdev; int ret;
- if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) {
DRM_DEV_ERROR(dev->dev, "too many bridges\n");return -ENOSPC;- }
- hdmi->dev = dev; hdmi->encoder = encoder;
On Mon, Sep 12, 2022 at 08:55:55PM +0300, Dmitry Baryshkov wrote:
On 12/09/2022 18:40, Johan Hovold wrote:
Add the missing sanity checks on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges.
a3376e3ec81c ("drm/msm: convert to drm_bridge") ab5b0107ccf3 ("drm/msm: Initial add eDP support in msm drm driver (v5)") a689554ba6ed ("drm/msm: Initial add DSI connector support")
Most probably you've missed the Fixes: here.
Indeed, thanks for catching that.
Fixes: 8a3b4c17f863 ("drm/msm/dp: employ bridge mechanism for display enable and disable") Cc: stable@vger.kernel.org # 3.12 Signed-off-by: Johan Hovold johan+linaro@kernel.org
drivers/gpu/drm/msm/dp/dp_display.c | 6 ++++++ drivers/gpu/drm/msm/dsi/dsi.c | 6 ++++++ drivers/gpu/drm/msm/hdmi/hdmi.c | 5 +++++
Could you please split this into respective dp/dsi/hdmi patches. This will assist both the review and the stable team.
Yeah, you're right, that should help the stable team if nothing else.
Otherwise LGTM.
Johan
linux-stable-mirror@lists.linaro.org
-
Dmitry Baryshkov -
Johan Hovold -
Johan Hovold