Patch "drm/i915/dsi: defend gpio table against out of bounds access" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

drm/i915/dsi: defend gpio table against out of bounds access

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
drm-i915-dsi-defend-gpio-table-against-out-of-bounds-access.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Jani Nikula <[email protected]>
Date: Thu, 4 Feb 2016 12:50:49 +0200
Subject: drm/i915/dsi: defend gpio table against out of bounds access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Jani Nikula <[email protected]>

commit 4db3a2448ec8902310acb78de39b6227a9a56ac8 upstream.

Do not blindly trust the VBT data used for indexing.

---
 drivers/gpu/drm/i915/intel_dsi_panel_vbt.c |    6 ++++++
 1 file changed, 6 insertions(+)

@@ -209,6 +209,11 @@ static const u8 *mipi_exec_gpio(struct i
 	/* pull up/down */
 	action = *data++;
 
+	if (gpio >= ARRAY_SIZE(gtable)) {
+		DRM_DEBUG_KMS("unknown gpio %u\n", gpio);
+		goto out;
+	}
+
 	function = gtable[gpio].function_reg;
 	pad = gtable[gpio].pad_reg;
 

@@ -226,6 +231,7 @@ static const u8 *mipi_exec_gpio(struct i
 	vlv_gpio_nc_write(dev_priv, pad, val);
 	mutex_unlock(&dev_priv->sb_lock);
 
+out:
 	return data;
 }
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/drm-i915-dp-fall-back-to-18-bpp-when-sink-capability-is-unknown.patch queue-4.4/drm-i915-init-power-domains-early-in-driver-load.patch queue-4.4/drm-i915-don-t-reject-primary-plane-windowing-with-color-keying-enabled-on-skl.patch queue-4.4/drm-i915-dsi-don-t-pass-arbitrary-data-to-sideband.patch queue-4.4/drm-i915-fix-error-path-in-intel_setup_gmbus.patch queue-4.4/drm-i915-make-sure-dc-writes-are-coherent-on-flush.patch queue-4.4/drm-i915-dsi-defend-gpio-table-against-out-of-bounds-access.patch queue-4.4/drm-i915-skl-don-t-skip-mst-encoders-in-skl_ddi_pll_select.patch queue-4.4/drm-i915-restore-inhibiting-the-load-of-the-default-context.patch queue-4.4/drm-i915-intel_hpd_init-fix-suspend-resume-reprobing.patch