From eeeebea6cbe0d85817e2fa8eee8a2f5c9d88a44a Mon Sep 17 00:00:00 2001 From: =?utf8?q?Ville=20Syrj=C3=A4l=C3=A4?= Date: Mon, 11 Apr 2016 10:22:09 +0300 Subject: [PATCH] drm/i915: Reject panel_type > 0xf from VBT MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit VBT can only contain 16 panel entries, indexed with the panel_type. To play it safe we should reject panel_type > 0xf, so that we don't read past the valid data. v2: Add debug logging (Jani) Cc: Jani Nikula Cc: Rob Kramer Signed-off-by: Ville Syrjälä Reviewed-by: Jani Nikula (v1) Link: http://patchwork.freedesktop.org/patch/msgid/1460359329-10817-1-git-send-email-ville.syrjala@linux.intel.com --- drivers/gpu/drm/i915/intel_bios.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c index eb756c41..c8857b5 100644 --- a/drivers/gpu/drm/i915/intel_bios.c +++ b/drivers/gpu/drm/i915/intel_bios.c @@ -212,8 +212,11 @@ parse_lfp_panel_data(struct drm_i915_private *dev_priv, return; dev_priv->vbt.lvds_dither = lvds_options->pixel_dither; - if (lvds_options->panel_type == 0xff) + if (lvds_options->panel_type > 0xf) { + DRM_DEBUG_KMS("Invalid VBT panel type 0x%x\n", + lvds_options->panel_type); return; + } panel_type = lvds_options->panel_type; -- 2.7.4