drm/i915: Validate BDB section before reading

Make sure that the whole BDB section is within the MMIO region prior to
accessing it contents. That we don't read outside of the secion is left
up to the individual section parsers.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@gmail.com>
Reviewed-by: Shobhit Kumar <shobhit.kumar@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 054dbe7fdf9b7d1fcbd7b73520aab8ebc43fb8f5..62dd370a36d8b2821a446e67e5d67d2bd10d5f13 100644 (file)
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -49,13 +49,19 @@ find_section(struct bdb_header *bdb, int section_id)
        total = bdb->bdb_size;
 
        /* walk the sections looking for section_id */
-       while (index < total) {
+       while (index + 3 < total) {
                current_id = *(base + index);
                index++;
+
                current_size = *((u16 *)(base + index));
                index += 2;
+
+               if (index + current_size > total)
+                       return NULL;
+
                if (current_id == section_id)
                        return base + index;
+
                index += current_size;
        }