| Message ID | 20240910134219.28479-2-ville.syrjala@linux.intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/i915/bios: Refactor ROM access | expand |
On Tue, 10 Sep 2024, Ville Syrjala <ville.syrjala@linux.intel.com> wrote: > From: Ville Syrjälä <ville.syrjala@linux.intel.com> > > Unify the SPI vs. PCI ROM VBT read codepaths a bit by > pulling some size overflow checks from the PCI side > into the SPI side. > > Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> > --- > drivers/gpu/drm/i915/display/intel_bios.c | 11 +++++++++++ > 1 file changed, 11 insertions(+) > > diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c > index cd32c9cd38a9..86b81fd23f58 100644 > --- a/drivers/gpu/drm/i915/display/intel_bios.c > +++ b/drivers/gpu/drm/i915/display/intel_bios.c > @@ -3088,11 +3088,22 @@ static struct vbt_header *spi_oprom_get_vbt(struct intel_display *display, > if (count >= oprom_size) > goto err_not_found; > > + if (sizeof(struct vbt_header) > oprom_size - count) { > + drm_dbg(display->drm, "VBT header incomplete\n"); > + goto err_not_found; > + } > + > /* Get VBT size and allocate space for the VBT */ > vbt_size = intel_spi_read(&i915->uncore, > found + offsetof(struct vbt_header, vbt_size)); > vbt_size &= 0xffff; > > + if (vbt_size > oprom_size - count) { > + drm_dbg(display->drm, > + "VBT incomplete (vbt_size overflows)\n"); > + goto err_not_found; > + } > + > vbt = kzalloc(round_up(vbt_size, 4), GFP_KERNEL); > if (!vbt) > goto err_not_found;
diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c index cd32c9cd38a9..86b81fd23f58 100644 --- a/drivers/gpu/drm/i915/display/intel_bios.c +++ b/drivers/gpu/drm/i915/display/intel_bios.c @@ -3088,11 +3088,22 @@ static struct vbt_header *spi_oprom_get_vbt(struct intel_display *display, if (count >= oprom_size) goto err_not_found; + if (sizeof(struct vbt_header) > oprom_size - count) { + drm_dbg(display->drm, "VBT header incomplete\n"); + goto err_not_found; + } + /* Get VBT size and allocate space for the VBT */ vbt_size = intel_spi_read(&i915->uncore, found + offsetof(struct vbt_header, vbt_size)); vbt_size &= 0xffff; + if (vbt_size > oprom_size - count) { + drm_dbg(display->drm, + "VBT incomplete (vbt_size overflows)\n"); + goto err_not_found; + } + vbt = kzalloc(round_up(vbt_size, 4), GFP_KERNEL); if (!vbt) goto err_not_found;