[Intel-gfx] [PATCH v2 04/22] drm/i915/bios: Validate LFP data table pointers

[Jani Nikula]

On Tue, 05 Apr 2022, Ville Syrjala <ville.syrjala at linux.intel.com> wrote:
> From: Ville Syrjälä <ville.syrjala at linux.intel.com>
>
> Make sure the LFP data table pointers sane. Sensible looking
> table entries, everything points correctly into the data block,
> etc.
>
> Signed-off-by: Ville Syrjälä <ville.syrjala at linux.intel.com>

I can't adequately describe my opinion about the design of the data
structures here. Sheesh.

Dunno why we keep struct lvds_lfp_data_entry and struct
bdb_lvds_lfp_data around, as they don't really reflect reality.

Reviewed-by: Jani Nikula <jani.nikula at intel.com>


> ---
>  drivers/gpu/drm/i915/display/intel_bios.c | 82 ++++++++++++++++++++++-
>  1 file changed, 81 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
> index 000544280c35..cd82ea4de8e1 100644
> --- a/drivers/gpu/drm/i915/display/intel_bios.c
> +++ b/drivers/gpu/drm/i915/display/intel_bios.c
> @@ -133,6 +133,18 @@ static u32 block_offset(const void *bdb, enum bdb_block_id section_id)
>  	return block - bdb;
>  }
>  
> +/* size of the block excluding the header */
> +static u32 block_size(const void *bdb, enum bdb_block_id section_id)
> +{
> +	const void *block;
> +
> +	block = find_raw_section(bdb, section_id);
> +	if (!block)
> +		return 0;
> +
> +	return get_blocksize(block);
> +}
> +
>  struct bdb_block_entry {
>  	struct list_head node;
>  	enum bdb_block_id section_id;
> @@ -191,6 +203,74 @@ static const struct {
>  	  .min_size = sizeof(struct bdb_generic_dtd), },
>  };
>  
> +static bool validate_lfp_data_ptrs(const void *bdb,
> +				   const struct bdb_lvds_lfp_data_ptrs *ptrs)
> +{
> +	int fp_timing_size, dvo_timing_size, panel_pnp_id_size;
> +	int data_block_size, lfp_data_size;
> +	int i;
> +
> +	data_block_size = block_size(bdb, BDB_LVDS_LFP_DATA);
> +	if (data_block_size == 0)
> +		return false;
> +
> +	/* always 3 indicating the presence of fp_timing+dvo_timing+panel_pnp_id */
> +	if (ptrs->lvds_entries != 3)
> +		return false;
> +
> +	fp_timing_size = ptrs->ptr[0].fp_timing.table_size;
> +	dvo_timing_size = ptrs->ptr[0].dvo_timing.table_size;
> +	panel_pnp_id_size = ptrs->ptr[0].panel_pnp_id.table_size;
> +
> +	/* fp_timing has variable size */
> +	if (fp_timing_size < 32 ||
> +	    dvo_timing_size != sizeof(struct lvds_dvo_timing) ||
> +	    panel_pnp_id_size != sizeof(struct lvds_pnp_id))
> +		return false;
> +
> +	lfp_data_size = ptrs->ptr[1].fp_timing.offset - ptrs->ptr[0].fp_timing.offset;
> +	if (16 * lfp_data_size > data_block_size)
> +		return false;
> +
> +	/*
> +	 * Except for vlv/chv machines all real VBTs seem to have 6
> +	 * unaccounted bytes in the fp_timing table. And it doesn't
> +	 * appear to be a really intentional hole as the fp_timing
> +	 * 0xffff terminator is always within those 6 missing bytes.
> +	 */
> +	if (fp_timing_size + dvo_timing_size + panel_pnp_id_size != lfp_data_size &&
> +	    fp_timing_size + 6 + dvo_timing_size + panel_pnp_id_size != lfp_data_size)
> +		return false;
> +
> +	if (ptrs->ptr[0].fp_timing.offset + fp_timing_size > ptrs->ptr[0].dvo_timing.offset ||
> +	    ptrs->ptr[0].dvo_timing.offset + dvo_timing_size != ptrs->ptr[0].panel_pnp_id.offset ||
> +	    ptrs->ptr[0].panel_pnp_id.offset + panel_pnp_id_size != lfp_data_size)
> +		return false;
> +
> +	/* make sure the table entries have uniform size */
> +	for (i = 1; i < 16; i++) {
> +		if (ptrs->ptr[i].fp_timing.table_size != fp_timing_size ||
> +		    ptrs->ptr[i].dvo_timing.table_size != dvo_timing_size ||
> +		    ptrs->ptr[i].panel_pnp_id.table_size != panel_pnp_id_size)
> +			return false;
> +
> +		if (ptrs->ptr[i].fp_timing.offset - ptrs->ptr[i-1].fp_timing.offset != lfp_data_size ||
> +		    ptrs->ptr[i].dvo_timing.offset - ptrs->ptr[i-1].dvo_timing.offset != lfp_data_size ||
> +		    ptrs->ptr[i].panel_pnp_id.offset - ptrs->ptr[i-1].panel_pnp_id.offset != lfp_data_size)
> +			return false;
> +	}
> +
> +	/* make sure the tables fit inside the data block */
> +	for (i = 0; i < 16; i++) {
> +		if (ptrs->ptr[i].fp_timing.offset + fp_timing_size > data_block_size ||
> +		    ptrs->ptr[i].dvo_timing.offset + dvo_timing_size > data_block_size ||
> +		    ptrs->ptr[i].panel_pnp_id.offset + panel_pnp_id_size > data_block_size)
> +			return false;
> +	}
> +
> +	return true;
> +}
> +
>  /* make the data table offsets relative to the data block */
>  static bool fixup_lfp_data_ptrs(const void *bdb, void *ptrs_block)
>  {
> @@ -211,7 +291,7 @@ static bool fixup_lfp_data_ptrs(const void *bdb, void *ptrs_block)
>  		ptrs->ptr[i].panel_pnp_id.offset -= offset;
>  	}
>  
> -	return true;
> +	return validate_lfp_data_ptrs(bdb, ptrs);
>  }
>  
>  static void

-- 
Jani Nikula, Intel Open Source Graphics Center