On Tue, 10 Sep 2024, Ville Syrjala <ville.syrjala@xxxxxxxxxxxxxxx> wrote:
> From: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
>
> Unify the SPI vs. PCI ROM VBT read codepaths a bit by
> pulling some size overflow checks from the PCI side
> into the SPI side.
>
> Signed-off-by: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
Reviewed-by: Jani Nikula <jani.nikula@xxxxxxxxx>
> ---
> drivers/gpu/drm/i915/display/intel_bios.c | 11 +++++++++++
> 1 file changed, 11 insertions(+)
>
> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
> index cd32c9cd38a9..86b81fd23f58 100644
> --- a/drivers/gpu/drm/i915/display/intel_bios.c
> +++ b/drivers/gpu/drm/i915/display/intel_bios.c
> @@ -3088,11 +3088,22 @@ static struct vbt_header *spi_oprom_get_vbt(struct intel_display *display,
> if (count >= oprom_size)
> goto err_not_found;
>
> + if (sizeof(struct vbt_header) > oprom_size - count) {
> + drm_dbg(display->drm, "VBT header incomplete\n");
> + goto err_not_found;
> + }
> +
> /* Get VBT size and allocate space for the VBT */
> vbt_size = intel_spi_read(&i915->uncore,
> found + offsetof(struct vbt_header, vbt_size));
> vbt_size &= 0xffff;
>
> + if (vbt_size > oprom_size - count) {
> + drm_dbg(display->drm,
> + "VBT incomplete (vbt_size overflows)\n");
> + goto err_not_found;
> + }
> +
> vbt = kzalloc(round_up(vbt_size, 4), GFP_KERNEL);
> if (!vbt)
> goto err_not_found;
--
Jani Nikula, Intel
