From: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
Unify the SPI vs. PCI ROM VBT read codepaths a bit by
pulling some size overflow checks from the PCI side
into the SPI side.
v2: s/drm_dbg()/drm_dbg_kms()/
Reviewed-by: Jani Nikula <jani.nikula@xxxxxxxxx>
Signed-off-by: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
---
drivers/gpu/drm/i915/display/intel_bios.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index b00aad23d6c2..37f30bb76e08 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -3088,11 +3088,22 @@ static struct vbt_header *spi_oprom_get_vbt(struct intel_display *display,
if (count >= oprom_size)
goto err_not_found;
+ if (sizeof(struct vbt_header) > oprom_size - count) {
+ drm_dbg_kms(display->drm, "VBT header incomplete\n");
+ goto err_not_found;
+ }
+
/* Get VBT size and allocate space for the VBT */
vbt_size = intel_spi_read(&i915->uncore,
found + offsetof(struct vbt_header, vbt_size));
vbt_size &= 0xffff;
+ if (vbt_size > oprom_size - count) {
+ drm_dbg_kms(display->drm,
+ "VBT incomplete (vbt_size overflows)\n");
+ goto err_not_found;
+ }
+
vbt = kzalloc(round_up(vbt_size, 4), GFP_KERNEL);
if (!vbt)
goto err_not_found;
--
2.44.2
