From nobody Sat Feb 7 13:52:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97955C04A95 for ; Sat, 22 Oct 2022 08:51:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231186AbiJVIvt (ORCPT ); Sat, 22 Oct 2022 04:51:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234489AbiJVIuD (ORCPT ); Sat, 22 Oct 2022 04:50:03 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 201ED2E32FB; Sat, 22 Oct 2022 01:11:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 073E8B82E41; Sat, 22 Oct 2022 08:08:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 87003C433C1; Sat, 22 Oct 2022 08:08:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666426096; bh=W4/yh7xZQybObDims9YbWGLF6sS6IkZ+HBTqyatr0Ks=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dq1o8u0Xxln/upeRiNMYUy6wex7QfDE9zmMc2j0Hzft5laH+7dUnEYxz6T5tcr5UI d2GDFExlKCU0Q/cZIcglPC8zjPiC3RPxq0v/pfdkjTBTjVAHuOMO/iC9/7Hu9wR4kS WgJEZFSTnR4HRpy8JSJM9jagH+kX34Roj6gLZSnM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= , Jani Nikula Subject: [PATCH 5.19 716/717] drm/i915/bios: Validate fp_timing terminator presence Date: Sat, 22 Oct 2022 09:29:55 +0200 Message-Id: <20221022072530.138458717@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221022072415.034382448@linuxfoundation.org> References: <20221022072415.034382448@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Ville Syrj=C3=A4l=C3=A4 commit 4e78d6023c15c6acce8fbe42e13027c460395522 upstream. Validate the LFP data block a bit hardwer by making sure the fp_timing terminators (0xffff) are where we expect them to be. Signed-off-by: Ville Syrj=C3=A4l=C3=A4 Link: https://patchwork.freedesktop.org/patch/msgid/20220818192223.29881-2-= ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/display/intel_bios.c | 60 ++++++++++++++++---------= ----- 1 file changed, 32 insertions(+), 28 deletions(-) --- a/drivers/gpu/drm/i915/display/intel_bios.c +++ b/drivers/gpu/drm/i915/display/intel_bios.c @@ -134,18 +134,6 @@ static u32 raw_block_offset(const void * return block - bdb; } =20 -/* size of the block excluding the header */ -static u32 raw_block_size(const void *bdb, enum bdb_block_id section_id) -{ - const void *block; - - block =3D find_raw_section(bdb, section_id); - if (!block) - return 0; - - return get_blocksize(block); -} - struct bdb_block_entry { struct list_head node; enum bdb_block_id section_id; @@ -230,9 +218,14 @@ static bool validate_lfp_data_ptrs(const { int fp_timing_size, dvo_timing_size, panel_pnp_id_size, panel_name_size; int data_block_size, lfp_data_size; + const void *data_block; int i; =20 - data_block_size =3D raw_block_size(bdb, BDB_LVDS_LFP_DATA); + data_block =3D find_raw_section(bdb, BDB_LVDS_LFP_DATA); + if (!data_block) + return false; + + data_block_size =3D get_blocksize(data_block); if (data_block_size =3D=3D 0) return false; =20 @@ -260,21 +253,6 @@ static bool validate_lfp_data_ptrs(const if (16 * lfp_data_size > data_block_size) return false; =20 - /* - * Except for vlv/chv machines all real VBTs seem to have 6 - * unaccounted bytes in the fp_timing table. And it doesn't - * appear to be a really intentional hole as the fp_timing - * 0xffff terminator is always within those 6 missing bytes. - */ - if (fp_timing_size + dvo_timing_size + panel_pnp_id_size !=3D lfp_data_si= ze && - fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size !=3D lfp_dat= a_size) - return false; - - if (ptrs->ptr[0].fp_timing.offset + fp_timing_size > ptrs->ptr[0].dvo_tim= ing.offset || - ptrs->ptr[0].dvo_timing.offset + dvo_timing_size !=3D ptrs->ptr[0].pa= nel_pnp_id.offset || - ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size !=3D lfp_data_si= ze) - return false; - /* make sure the table entries have uniform size */ for (i =3D 1; i < 16; i++) { if (ptrs->ptr[i].fp_timing.table_size !=3D fp_timing_size || @@ -288,6 +266,23 @@ static bool validate_lfp_data_ptrs(const return false; } =20 + /* + * Except for vlv/chv machines all real VBTs seem to have 6 + * unaccounted bytes in the fp_timing table. And it doesn't + * appear to be a really intentional hole as the fp_timing + * 0xffff terminator is always within those 6 missing bytes. + */ + if (fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size =3D=3D lfp_d= ata_size) + fp_timing_size +=3D 6; + + if (fp_timing_size + dvo_timing_size + panel_pnp_id_size !=3D lfp_data_si= ze) + return false; + + if (ptrs->ptr[0].fp_timing.offset + fp_timing_size !=3D ptrs->ptr[0].dvo_= timing.offset || + ptrs->ptr[0].dvo_timing.offset + dvo_timing_size !=3D ptrs->ptr[0].pa= nel_pnp_id.offset || + ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size !=3D lfp_data_si= ze) + return false; + /* make sure the tables fit inside the data block */ for (i =3D 0; i < 16; i++) { if (ptrs->ptr[i].fp_timing.offset + fp_timing_size > data_block_size || @@ -299,6 +294,15 @@ static bool validate_lfp_data_ptrs(const if (ptrs->panel_name.offset + 16 * panel_name_size > data_block_size) return false; =20 + /* make sure fp_timing terminators are present at expected locations */ + for (i =3D 0; i < 16; i++) { + const u16 *t =3D data_block + ptrs->ptr[i].fp_timing.offset + + fp_timing_size - 2; + + if (*t !=3D 0xffff) + return false; + } + return true; } =20