Patch "drm/i915/bios: handle MIPI Sequence Block v3+ gracefully" has been added to the 4.1-stable tree

This is a note to let you know that I've just added the patch titled

drm/i915/bios: handle MIPI Sequence Block v3+ gracefully

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
drm-i915-bios-handle-mipi-sequence-block-v3-gracefully.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Jani Nikula <[email protected]>
Date: Thu, 17 Sep 2015 16:42:07 +0300
Subject: drm/i915/bios: handle MIPI Sequence Block v3+ gracefully

From: Jani Nikula <[email protected]>

commit cd67d226ebd909d239d2c6e5a6abd6e2a338d1cd upstream.

The VBT MIPI Sequence Block version 3 has forward incompatible changes:

First, the block size in the header has been specified reserved, and the actual size is a separate 32-bit value within the block. The current find_section() function to will only look at the size in the block header, and, depending on what's in that now reserved size field, continue looking for other sections in the wrong place.

Fix this by taking the new block size field into account. This will ensure that the lookups for other sections will work properly, as long as the new 32-bit size does not go beyond the opregion VBT mailbox size.

Second, the contents of the block have been completely changed. Gracefully refuse parsing the yet unknown data version.

---
 drivers/gpu/drm/i915/intel_bios.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

@@ -41,7 +41,7 @@ find_section(struct bdb_header *bdb, int
 {
 	u8 *base = (u8 *)bdb;
 	int index = 0;
-	u16 total, current_size;
+	u32 total, current_size;
 	u8 current_id;
 
 	/* skip to first section */

@@ -56,6 +56,10 @@ find_section(struct bdb_header *bdb, int
 		current_size = *((u16 *)(base + index));
 		index += 2;
 
+		/* The MIPI Sequence Block v3+ has a separate size field. */
+		if (current_id == BDB_MIPI_SEQUENCE && *(base + index) >= 3)
+			current_size = *((const u32 *)(base + index + 1));
+
 		if (index + current_size > total)
 			return NULL;
 

@@ -845,6 +849,12 @@ parse_mipi(struct drm_i915_private *dev_
 		return;
 	}
 
+	/* Fail gracefully for forward incompatible sequence block. */
+	if (sequence->version >= 3) {
+		DRM_ERROR("Unable to parse MIPI Sequence Block v3+\n");
+		return;
+	}
+
 	DRM_DEBUG_DRIVER("Found MIPI sequence block\n");
 
 	block_size = get_blocksize(sequence);

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/drm-i915-bios-handle-mipi-sequence-block-v3-gracefully.patch