From: Jani Nikula <jani.nikula@intel.com>
Date: Mon, 19 Sep 2016 12:02:30 +0000 (+0300)
Subject: drm/i915/dsi: double check element parsing against size if present
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=8e4f768c434e3c197a1b6d59c8e6d0807b10c4cd;p=linux-beck.git

drm/i915/dsi: double check element parsing against size if present

Be a little paranoid in case the specs change or something.

Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/27050d48d0ff3d58e79fcacc41ced4c071b01424.1474286487.git.jani.nikula@intel.com
---

diff --git a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
index 24953f9f7e1d..9f279a3d0f74 100644
--- a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
+++ b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
@@ -441,7 +441,15 @@ static void generic_exec_sequence(struct drm_panel *panel, enum mipi_seq seq_id)
 			operation_size = *data++;
 
 		if (mipi_elem_exec) {
+			const u8 *next = data + operation_size;
+
 			data = mipi_elem_exec(intel_dsi, data);
+
+			/* Consistency check if we have size. */
+			if (operation_size && data != next) {
+				DRM_ERROR("Inconsistent operation size\n");
+				return;
+			}
 		} else if (operation_size) {
 			/* We have size, skip. */
 			DRM_DEBUG_KMS("Unsupported MIPI operation byte %u\n",