From: Ville Syrjälä Date: Mon, 11 Apr 2016 07:22:09 +0000 (+0300) Subject: drm/i915: Reject panel_type > 0xf from VBT X-Git-Tag: v4.7-rc1~77^2~37^2~135 X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=eeeebea6cbe0d85817e2fa8eee8a2f5c9d88a44a;p=karo-tx-linux.git drm/i915: Reject panel_type > 0xf from VBT VBT can only contain 16 panel entries, indexed with the panel_type. To play it safe we should reject panel_type > 0xf, so that we don't read past the valid data. v2: Add debug logging (Jani) Cc: Jani Nikula Cc: Rob Kramer Signed-off-by: Ville Syrjälä Reviewed-by: Jani Nikula (v1) Link: http://patchwork.freedesktop.org/patch/msgid/1460359329-10817-1-git-send-email-ville.syrjala@linux.intel.com --- diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c index eb756c41d9e1..c8857b5dbfec 100644 --- a/drivers/gpu/drm/i915/intel_bios.c +++ b/drivers/gpu/drm/i915/intel_bios.c @@ -212,8 +212,11 @@ parse_lfp_panel_data(struct drm_i915_private *dev_priv, return; dev_priv->vbt.lvds_dither = lvds_options->pixel_dither; - if (lvds_options->panel_type == 0xff) + if (lvds_options->panel_type > 0xf) { + DRM_DEBUG_KMS("Invalid VBT panel type 0x%x\n", + lvds_options->panel_type); return; + } panel_type = lvds_options->panel_type;