[PATCH 1/5] drm/i915/bios: Add some size checks to SPI VBT read

[Jani Nikula]

On Tue, 10 Sep 2024, Ville Syrjala <ville.syrjala at linux.intel.com> wrote:
> From: Ville Syrjälä <ville.syrjala at linux.intel.com>
>
> Unify the SPI vs. PCI ROM VBT read codepaths a bit by
> pulling some size overflow checks from the PCI side
> into the SPI side.
>
> Signed-off-by: Ville Syrjälä <ville.syrjala at linux.intel.com>

Reviewed-by: Jani Nikula <jani.nikula at intel.com>

> ---
>  drivers/gpu/drm/i915/display/intel_bios.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
>
> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
> index cd32c9cd38a9..86b81fd23f58 100644
> --- a/drivers/gpu/drm/i915/display/intel_bios.c
> +++ b/drivers/gpu/drm/i915/display/intel_bios.c
> @@ -3088,11 +3088,22 @@ static struct vbt_header *spi_oprom_get_vbt(struct intel_display *display,
>  	if (count >= oprom_size)
>  		goto err_not_found;
>  
> +	if (sizeof(struct vbt_header) > oprom_size - count) {
> +		drm_dbg(display->drm, "VBT header incomplete\n");
> +		goto err_not_found;
> +	}
> +
>  	/* Get VBT size and allocate space for the VBT */
>  	vbt_size = intel_spi_read(&i915->uncore,
>  				  found + offsetof(struct vbt_header, vbt_size));
>  	vbt_size &= 0xffff;
>  
> +	if (vbt_size > oprom_size - count) {
> +		drm_dbg(display->drm,
> +			"VBT incomplete (vbt_size overflows)\n");
> +		goto err_not_found;
> +	}
> +
>  	vbt = kzalloc(round_up(vbt_size, 4), GFP_KERNEL);
>  	if (!vbt)
>  		goto err_not_found;

-- 
Jani Nikula, Intel