From patchwork Sat Oct 22 07:29:55 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 7739 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4242:0:0:0:0:0 with SMTP id s2csp1110623wrr; Sat, 22 Oct 2022 01:53:30 -0700 (PDT) X-Google-Smtp-Source: AMsMyM6Kdj7xALeSAJitY7R+rEs0KmYZ2D6rjI7Ut6FGH+9Qpg3mCDUFpsZD0F44wkKl5J0S2pqh X-Received: by 2002:a17:906:99c2:b0:78d:b5cf:419e with SMTP id s2-20020a17090699c200b0078db5cf419emr19398998ejn.673.1666428800061; Sat, 22 Oct 2022 01:53:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666428800; cv=none; d=google.com; s=arc-20160816; b=VdG1QymdpuBs/R/LAZwOp49Ih8klLVuzeE7zp2wyTw8h27ybnBt0t5eapb7+IbwP2S boS+N03e369tQ6cbtqN4vI6RV3dkCr1PU94Yv49TpDsvOV04UnxcBKbu5ddOeR6EiVlm hZHa3rn/DUjWPUdeP3A92f+Z2mqzklU6MmSum15glZODFXW6Bz3Ps76oGJwow5ZuH98F BNw/92qgMgpR+KDvPIqNaZJqM0fSqXWDr9KYlFc/v1E1rNxIZRDxgcLEgn6XMn+d9Lh3 kNOYXYYyQhXv/6byS/0RzMQRDEzYuHhc/I6B1+jvdvtMKN7Fyzz0s6VzuDglzRUCavnz JpHg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=kgd68feF0KaJ1rmNVkX9AXS8EHAm3W23WIdfHyav0kk=; b=v0ATFO4o/HORDmXl9EM3466HkvPje1T8FqM3xgOnTeqRAylzPYXKDJUkQS/VbdavJg 6T3+zrIPnrNV2UPO0KxCCmXuqtqo2LJCQqExDaaE8CwvvxcQSBTWrYQK8FCZLbByWqgv yrUe1wzYJg+Sze6Bh8rhAJzy/xQM1bx/RGsWVKLTXAyn387GroJrfIURex1MSBPHGbWs cr0QF+wSwE58CW/ANvAB7bfvttOTK/M13R0z2TV8a65GehZ+bjqvt2/r3VOKxRv64UVI 4ZTU160Le0abc1r3HNIt43fCrP0GlvTcypwo7CG3QAiN3sagZ9aKOgV9jbJ9+reV1PMQ tapw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=dq1o8u0X; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id q6-20020a056402518600b0045981993486si23503704edd.227.2022.10.22.01.52.56; Sat, 22 Oct 2022 01:53:20 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=dq1o8u0X; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234650AbiJVIvs (ORCPT + 99 others); Sat, 22 Oct 2022 04:51:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234489AbiJVIuD (ORCPT ); Sat, 22 Oct 2022 04:50:03 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 201ED2E32FB; Sat, 22 Oct 2022 01:11:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 073E8B82E41; Sat, 22 Oct 2022 08:08:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 87003C433C1; Sat, 22 Oct 2022 08:08:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666426096; bh=W4/yh7xZQybObDims9YbWGLF6sS6IkZ+HBTqyatr0Ks=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dq1o8u0Xxln/upeRiNMYUy6wex7QfDE9zmMc2j0Hzft5laH+7dUnEYxz6T5tcr5UI d2GDFExlKCU0Q/cZIcglPC8zjPiC3RPxq0v/pfdkjTBTjVAHuOMO/iC9/7Hu9wR4kS WgJEZFSTnR4HRpy8JSJM9jagH+kX34Roj6gLZSnM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?utf-8?b?VmlsbGUgU3lyasOkbMOk?= , Jani Nikula Subject: [PATCH 5.19 716/717] drm/i915/bios: Validate fp_timing terminator presence Date: Sat, 22 Oct 2022 09:29:55 +0200 Message-Id: <20221022072530.138458717@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221022072415.034382448@linuxfoundation.org> References: <20221022072415.034382448@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747377245508273953?= X-GMAIL-MSGID: =?utf-8?q?1747377245508273953?= From: Ville Syrjälä commit 4e78d6023c15c6acce8fbe42e13027c460395522 upstream. Validate the LFP data block a bit hardwer by making sure the fp_timing terminators (0xffff) are where we expect them to be. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20220818192223.29881-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/display/intel_bios.c | 60 ++++++++++++++++-------------- 1 file changed, 32 insertions(+), 28 deletions(-) --- a/drivers/gpu/drm/i915/display/intel_bios.c +++ b/drivers/gpu/drm/i915/display/intel_bios.c @@ -134,18 +134,6 @@ static u32 raw_block_offset(const void * return block - bdb; } -/* size of the block excluding the header */ -static u32 raw_block_size(const void *bdb, enum bdb_block_id section_id) -{ - const void *block; - - block = find_raw_section(bdb, section_id); - if (!block) - return 0; - - return get_blocksize(block); -} - struct bdb_block_entry { struct list_head node; enum bdb_block_id section_id; @@ -230,9 +218,14 @@ static bool validate_lfp_data_ptrs(const { int fp_timing_size, dvo_timing_size, panel_pnp_id_size, panel_name_size; int data_block_size, lfp_data_size; + const void *data_block; int i; - data_block_size = raw_block_size(bdb, BDB_LVDS_LFP_DATA); + data_block = find_raw_section(bdb, BDB_LVDS_LFP_DATA); + if (!data_block) + return false; + + data_block_size = get_blocksize(data_block); if (data_block_size == 0) return false; @@ -260,21 +253,6 @@ static bool validate_lfp_data_ptrs(const if (16 * lfp_data_size > data_block_size) return false; - /* - * Except for vlv/chv machines all real VBTs seem to have 6 - * unaccounted bytes in the fp_timing table. And it doesn't - * appear to be a really intentional hole as the fp_timing - * 0xffff terminator is always within those 6 missing bytes. - */ - if (fp_timing_size + dvo_timing_size + panel_pnp_id_size != lfp_data_size && - fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size != lfp_data_size) - return false; - - if (ptrs->ptr[0].fp_timing.offset + fp_timing_size > ptrs->ptr[0].dvo_timing.offset || - ptrs->ptr[0].dvo_timing.offset + dvo_timing_size != ptrs->ptr[0].panel_pnp_id.offset || - ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size != lfp_data_size) - return false; - /* make sure the table entries have uniform size */ for (i = 1; i < 16; i++) { if (ptrs->ptr[i].fp_timing.table_size != fp_timing_size || @@ -288,6 +266,23 @@ static bool validate_lfp_data_ptrs(const return false; } + /* + * Except for vlv/chv machines all real VBTs seem to have 6 + * unaccounted bytes in the fp_timing table. And it doesn't + * appear to be a really intentional hole as the fp_timing + * 0xffff terminator is always within those 6 missing bytes. + */ + if (fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size == lfp_data_size) + fp_timing_size += 6; + + if (fp_timing_size + dvo_timing_size + panel_pnp_id_size != lfp_data_size) + return false; + + if (ptrs->ptr[0].fp_timing.offset + fp_timing_size != ptrs->ptr[0].dvo_timing.offset || + ptrs->ptr[0].dvo_timing.offset + dvo_timing_size != ptrs->ptr[0].panel_pnp_id.offset || + ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size != lfp_data_size) + return false; + /* make sure the tables fit inside the data block */ for (i = 0; i < 16; i++) { if (ptrs->ptr[i].fp_timing.offset + fp_timing_size > data_block_size || @@ -299,6 +294,15 @@ static bool validate_lfp_data_ptrs(const if (ptrs->panel_name.offset + 16 * panel_name_size > data_block_size) return false; + /* make sure fp_timing terminators are present at expected locations */ + for (i = 0; i < 16; i++) { + const u16 *t = data_block + ptrs->ptr[i].fp_timing.offset + + fp_timing_size - 2; + + if (*t != 0xffff) + return false; + } + return true; }