drm/i915: Reject panel_type > 0xf from VBT
authorVille Syrjälä <ville.syrjala@linux.intel.com>
Mon, 11 Apr 2016 07:22:09 +0000 (10:22 +0300)
committerVille Syrjälä <ville.syrjala@linux.intel.com>
Tue, 12 Apr 2016 10:23:42 +0000 (13:23 +0300)
VBT can only contain 16 panel entries, indexed with the panel_type.
To play it safe we should reject panel_type > 0xf, so that we don't
read past the valid data.

v2: Add debug logging (Jani)

Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Rob Kramer <rob@solution-space.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: Jani Nikula <jani.nikula@intel.com> (v1)
Link: http://patchwork.freedesktop.org/patch/msgid/1460359329-10817-1-git-send-email-ville.syrjala@linux.intel.com
drivers/gpu/drm/i915/intel_bios.c

index eb756c41d9e1343116a285fb1bb250dab80c661e..c8857b5dbfec5eba2b34cac3268b53e288a29461 100644 (file)
@@ -212,8 +212,11 @@ parse_lfp_panel_data(struct drm_i915_private *dev_priv,
                return;
 
        dev_priv->vbt.lvds_dither = lvds_options->pixel_dither;
-       if (lvds_options->panel_type == 0xff)
+       if (lvds_options->panel_type > 0xf) {
+               DRM_DEBUG_KMS("Invalid VBT panel type 0x%x\n",
+                             lvds_options->panel_type);
                return;
+       }
 
        panel_type = lvds_options->panel_type;