Commit 514003e1 authored by Ville Syrjälä's avatar Ville Syrjälä
Browse files

drm/i915/bios: Validate LFP data table pointers 



Make sure the LFP data table pointers sane. Sensible looking
table entries, everything points correctly into the data block,
etc.

Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220405173410.11436-5-ville.syrjala@linux.intel.com


Reviewed-by: default avatarJani Nikula <jani.nikula@intel.com>
parent 918f3025

drivers/gpu/drm/i915/display/intel_bios.c

+81 −1
Original line number Diff line number Diff line
@@ -133,6 +133,18 @@ static u32 block_offset(const void *bdb, enum bdb_block_id section_id) 
	return block - bdb;

}



/* size of the block excluding the header */

static u32 block_size(const void *bdb, enum bdb_block_id section_id)

{

	const void *block;



	block = find_raw_section(bdb, section_id);

	if (!block)

		return 0;



	return get_blocksize(block);

}



struct bdb_block_entry {

	struct list_head node;

	enum bdb_block_id section_id;
@@ -191,6 +203,74 @@ static const struct { 
	  .min_size = sizeof(struct bdb_generic_dtd), },

};



static bool validate_lfp_data_ptrs(const void *bdb,

				   const struct bdb_lvds_lfp_data_ptrs *ptrs)

{

	int fp_timing_size, dvo_timing_size, panel_pnp_id_size;

	int data_block_size, lfp_data_size;

	int i;



	data_block_size = block_size(bdb, BDB_LVDS_LFP_DATA);

	if (data_block_size == 0)

		return false;



	/* always 3 indicating the presence of fp_timing+dvo_timing+panel_pnp_id */

	if (ptrs->lvds_entries != 3)

		return false;



	fp_timing_size = ptrs->ptr[0].fp_timing.table_size;

	dvo_timing_size = ptrs->ptr[0].dvo_timing.table_size;

	panel_pnp_id_size = ptrs->ptr[0].panel_pnp_id.table_size;



	/* fp_timing has variable size */

	if (fp_timing_size < 32 ||

	    dvo_timing_size != sizeof(struct lvds_dvo_timing) ||

	    panel_pnp_id_size != sizeof(struct lvds_pnp_id))

		return false;



	lfp_data_size = ptrs->ptr[1].fp_timing.offset - ptrs->ptr[0].fp_timing.offset;

	if (16 * lfp_data_size > data_block_size)

		return false;



	/*

	 * Except for vlv/chv machines all real VBTs seem to have 6

	 * unaccounted bytes in the fp_timing table. And it doesn't

	 * appear to be a really intentional hole as the fp_timing

	 * 0xffff terminator is always within those 6 missing bytes.

	 */

	if (fp_timing_size + dvo_timing_size + panel_pnp_id_size != lfp_data_size &&

	    fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size != lfp_data_size)

		return false;



	if (ptrs->ptr[0].fp_timing.offset + fp_timing_size > ptrs->ptr[0].dvo_timing.offset ||

	    ptrs->ptr[0].dvo_timing.offset + dvo_timing_size != ptrs->ptr[0].panel_pnp_id.offset ||

	    ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size != lfp_data_size)

		return false;



	/* make sure the table entries have uniform size */

	for (i = 1; i < 16; i++) {

		if (ptrs->ptr[i].fp_timing.table_size != fp_timing_size ||

		    ptrs->ptr[i].dvo_timing.table_size != dvo_timing_size ||

		    ptrs->ptr[i].panel_pnp_id.table_size != panel_pnp_id_size)

			return false;



		if (ptrs->ptr[i].fp_timing.offset - ptrs->ptr[i-1].fp_timing.offset != lfp_data_size ||

		    ptrs->ptr[i].dvo_timing.offset - ptrs->ptr[i-1].dvo_timing.offset != lfp_data_size ||

		    ptrs->ptr[i].panel_pnp_id.offset - ptrs->ptr[i-1].panel_pnp_id.offset != lfp_data_size)

			return false;

	}



	/* make sure the tables fit inside the data block */

	for (i = 0; i < 16; i++) {

		if (ptrs->ptr[i].fp_timing.offset + fp_timing_size > data_block_size ||

		    ptrs->ptr[i].dvo_timing.offset + dvo_timing_size > data_block_size ||

		    ptrs->ptr[i].panel_pnp_id.offset + panel_pnp_id_size > data_block_size)

			return false;

	}



	return true;

}



/* make the data table offsets relative to the data block */

static bool fixup_lfp_data_ptrs(const void *bdb, void *ptrs_block)

{
@@ -211,7 +291,7 @@ static bool fixup_lfp_data_ptrs(const void *bdb, void *ptrs_block) 
		ptrs->ptr[i].panel_pnp_id.offset -= offset;

	}



	return true;

	return validate_lfp_data_ptrs(bdb, ptrs);

}



static void