[Intel-gfx] [PATCH 1/8] drm/i915/dsi: defend gpio table against out of bounds access

[Ville Syrjälä]

On Thu, Feb 04, 2016 at 12:50:49PM +0200, Jani Nikula wrote:
> Do not blindly trust the VBT data used for indexing.
> 
> Cc: stable at vger.kernel.org
> Signed-off-by: Jani Nikula <jani.nikula at intel.com>

Reviewed-by: Ville Syrjälä <ville.syrjala at linux.intel.com>

> ---
>  drivers/gpu/drm/i915/intel_dsi_panel_vbt.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
> index 1d43e6f37fc1..4775aa5462e8 100644
> --- a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
> +++ b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
> @@ -209,6 +209,11 @@ static const u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, const u8 *data)
>  	/* pull up/down */
>  	action = *data++;
>  
> +	if (gpio >= ARRAY_SIZE(gtable)) {
> +		DRM_DEBUG_KMS("unknown gpio %u\n", gpio);
> +		goto out;
> +	}
> +
>  	function = gtable[gpio].function_reg;
>  	pad = gtable[gpio].pad_reg;
>  
> @@ -226,6 +231,7 @@ static const u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, const u8 *data)
>  	vlv_gpio_nc_write(dev_priv, pad, val);
>  	mutex_unlock(&dev_priv->sb_lock);
>  
> +out:
>  	return data;
>  }
>  
> -- 
> 2.1.4
> 
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx

-- 
Ville Syrjälä
Intel OTC