drm/i915/bios: Validate LFP data table pointers

Make sure the LFP data table pointers sane. Sensible looking
table entries, everything points correctly into the data block,
etc.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220405173410.11436-5-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>

diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index ed5edff3bebc48173ce8cc620669357246a25f52..de1c4bea71254dcf7fcad70b305a0500bb8d7045 100644 (file)
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -133,6 +133,18 @@ static u32 block_offset(const void *bdb, enum bdb_block_id section_id)
        return block - bdb;
 }
 
+/* size of the block excluding the header */
+static u32 block_size(const void *bdb, enum bdb_block_id section_id)
+{
+       const void *block;
+
+       block = find_raw_section(bdb, section_id);
+       if (!block)
+               return 0;
+
+       return get_blocksize(block);
+}
+
 struct bdb_block_entry {
        struct list_head node;
        enum bdb_block_id section_id;
@@ -191,6 +203,74 @@ static const struct {
          .min_size = sizeof(struct bdb_generic_dtd), },
 };
 
+static bool validate_lfp_data_ptrs(const void *bdb,
+                                  const struct bdb_lvds_lfp_data_ptrs *ptrs)
+{
+       int fp_timing_size, dvo_timing_size, panel_pnp_id_size;
+       int data_block_size, lfp_data_size;
+       int i;
+
+       data_block_size = block_size(bdb, BDB_LVDS_LFP_DATA);
+       if (data_block_size == 0)
+               return false;
+
+       /* always 3 indicating the presence of fp_timing+dvo_timing+panel_pnp_id */
+       if (ptrs->lvds_entries != 3)
+               return false;
+
+       fp_timing_size = ptrs->ptr[0].fp_timing.table_size;
+       dvo_timing_size = ptrs->ptr[0].dvo_timing.table_size;
+       panel_pnp_id_size = ptrs->ptr[0].panel_pnp_id.table_size;
+
+       /* fp_timing has variable size */
+       if (fp_timing_size < 32 ||
+           dvo_timing_size != sizeof(struct lvds_dvo_timing) ||
+           panel_pnp_id_size != sizeof(struct lvds_pnp_id))
+               return false;
+
+       lfp_data_size = ptrs->ptr[1].fp_timing.offset - ptrs->ptr[0].fp_timing.offset;
+       if (16 * lfp_data_size > data_block_size)
+               return false;
+
+       /*
+        * Except for vlv/chv machines all real VBTs seem to have 6
+        * unaccounted bytes in the fp_timing table. And it doesn't
+        * appear to be a really intentional hole as the fp_timing
+        * 0xffff terminator is always within those 6 missing bytes.
+        */
+       if (fp_timing_size + dvo_timing_size + panel_pnp_id_size != lfp_data_size &&
+           fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size != lfp_data_size)
+               return false;
+
+       if (ptrs->ptr[0].fp_timing.offset + fp_timing_size > ptrs->ptr[0].dvo_timing.offset ||
+           ptrs->ptr[0].dvo_timing.offset + dvo_timing_size != ptrs->ptr[0].panel_pnp_id.offset ||
+           ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size != lfp_data_size)
+               return false;
+
+       /* make sure the table entries have uniform size */
+       for (i = 1; i < 16; i++) {
+               if (ptrs->ptr[i].fp_timing.table_size != fp_timing_size ||
+                   ptrs->ptr[i].dvo_timing.table_size != dvo_timing_size ||
+                   ptrs->ptr[i].panel_pnp_id.table_size != panel_pnp_id_size)
+                       return false;
+
+               if (ptrs->ptr[i].fp_timing.offset - ptrs->ptr[i-1].fp_timing.offset != lfp_data_size ||
+                   ptrs->ptr[i].dvo_timing.offset - ptrs->ptr[i-1].dvo_timing.offset != lfp_data_size ||
+                   ptrs->ptr[i].panel_pnp_id.offset - ptrs->ptr[i-1].panel_pnp_id.offset != lfp_data_size)
+                       return false;
+       }
+
+       /* make sure the tables fit inside the data block */
+       for (i = 0; i < 16; i++) {
+               if (ptrs->ptr[i].fp_timing.offset + fp_timing_size > data_block_size ||
+                   ptrs->ptr[i].dvo_timing.offset + dvo_timing_size > data_block_size ||
+                   ptrs->ptr[i].panel_pnp_id.offset + panel_pnp_id_size > data_block_size)
+                       return false;
+       }
+
+       return true;
+}
+
 /* make the data table offsets relative to the data block */
 static bool fixup_lfp_data_ptrs(const void *bdb, void *ptrs_block)
 {
@@ -211,7 +291,7 @@ static bool fixup_lfp_data_ptrs(const void *bdb, void *ptrs_block)
                ptrs->ptr[i].panel_pnp_id.offset -= offset;
        }
 
-       return true;
+       return validate_lfp_data_ptrs(bdb, ptrs);
 }
 
 static void