From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D7695C43458 for ; Tue, 30 Jun 2026 09:09:12 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 6B64810EBC7; Tue, 30 Jun 2026 09:09:12 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=intel.com header.i=@intel.com header.b="LDN676l2"; dkim-atps=neutral Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.16]) by gabe.freedesktop.org (Postfix) with ESMTPS id 85B3A10EBB6; Tue, 30 Jun 2026 09:09:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1782810552; x=1814346552; h=from:to:cc:subject:in-reply-to:references:date: message-id:mime-version:content-transfer-encoding; bh=ZT5/YqAdR06D3iEcqa+qTOlX/3Y86xOSgxVe475ekKQ=; b=LDN676l2CBCGYcp4nD1U23o9stf5uVK8CqopbzpnQyqCPoZFkhRX65Xq oX3PoeCPgr3Ly8d73cYuSQ+w/umNxSNbJyhbL7P+J9lOCheBA8nzqEot8 UdW6JW8Dz8on9MEj3CUBUSVk8bLk3q0inP52Ky2Zzx/y+Z34jIX07chd/ WZD4/Uhd45ZU/DPTg/Pvu3wJcU/YWDnLcdgM1qiKlArlY2uKVRFL7W6CA bLpmYkxicNo80/a54PBlpu3w9I4biw+3wpUHtDQd8Ved7tRs3NieUlNP2 o1W8iQDHB64Ux+ngBGQ6/sfXetbbfyTMR+AEpcpafc0NFxMEeh5xSaAbr A==; X-CSE-ConnectionGUID: irgwILNLQ5KNh940KKNtqg== X-CSE-MsgGUID: DnqOgCyKQ+uym4LWnhsVqQ== X-IronPort-AV: E=McAfee;i="6800,10657,11832"; a="83715714" X-IronPort-AV: E=Sophos;i="6.24,233,1774335600"; d="scan'208";a="83715714" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by orvoesa108.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Jun 2026 02:09:12 -0700 X-CSE-ConnectionGUID: 3rJaxcJtQ6+vhxSNpjY94A== X-CSE-MsgGUID: XtPPmhh0R/eOEcD+0WaoYw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.24,233,1774335600"; d="scan'208";a="250518809" Received: from ijarvine-mobl1.ger.corp.intel.com (HELO localhost) ([10.245.245.148]) by orviesa006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Jun 2026 02:09:08 -0700 From: Jani Nikula To: Ville =?utf-8?B?U3lyasOkbMOk?= Cc: intel-gfx@lists.freedesktop.org, intel-xe@lists.freedesktop.org, Martin Hodo , stable@vger.kernel.org, Animesh Manna , Ville =?utf-8?B?U3lyasOkbMOk?= , =?utf-8?Q?Micha=C5=82?= Grzelak Subject: Re: [PATCH v2] drm/i915/bios: range check LFP Data Block panel_type2 In-Reply-To: Organization: Intel Finland Oy - BIC 0357606-4 - c/o Alberga Business Park, 6 krs Bertel Jungin Aukio 5, 02600 Espoo, Finland References: <20260625135130.1067872-1-jani.nikula@intel.com> <20260626140155.1389655-1-jani.nikula@intel.com> Date: Tue, 30 Jun 2026 12:09:06 +0300 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" On Tue, 30 Jun 2026, Ville Syrj=C3=A4l=C3=A4 wrote: > On Fri, Jun 26, 2026 at 05:01:55PM +0300, Jani Nikula wrote: >> While the panel_type from LFP Data Block is range checked, panel_type2 >> is not. Add a few helpers for range checking, and use them to not only >> check panel_type2, but also improve clarity and correctness in the panel >> type selection. >>=20 >> Discovered using AI-assisted static analysis confirmed by Intel Product >> Security. >>=20 >> v2: >> - Fix commit message typo (Micha=C5=82) >> - Add is_panel_type_pnp() (Ville) >>=20 >> Reported-by: Martin Hodo >> Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child d= evice index in VBT") >> Cc: # v6.0+ >> Cc: Animesh Manna >> Cc: Ville Syrj=C3=A4l=C3=A4 >> Reviewed-by: Micha=C5=82 Grzelak # v1 >> Signed-off-by: Jani Nikula >> --- >> drivers/gpu/drm/i915/display/intel_bios.c | 36 ++++++++++++++++++----- >> 1 file changed, 28 insertions(+), 8 deletions(-) >>=20 >> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm= /i915/display/intel_bios.c >> index 15ebadc72b88..97cbae2e547e 100644 >> --- a/drivers/gpu/drm/i915/display/intel_bios.c >> +++ b/drivers/gpu/drm/i915/display/intel_bios.c >> @@ -623,6 +623,21 @@ get_lfp_data_tail(const struct bdb_lfp_data *data, >> return NULL; >> } >>=20=20 >> +static bool is_panel_type_valid(int panel_type) >> +{ >> + return panel_type >=3D 0 && panel_type < 16; >> +} >> + >> +static bool is_panel_type_pnp(int panel_type) >> +{ >> + return panel_type =3D=3D 0xff; >> +} >> + >> +static bool is_panel_type_valid_or_pnp(int panel_type) >> +{ >> + return is_panel_type_valid(panel_type) || is_panel_type_pnp(panel_type= ); >> +} >> + >> static int opregion_get_panel_type(struct intel_display *display, >> const struct intel_bios_encoder_data *devdata, >> const struct drm_edid *drm_edid, bool use_fallback) >> @@ -640,15 +655,21 @@ static int vbt_get_panel_type(struct intel_display= *display, >> if (!lfp_options) >> return -1; >>=20=20 >> - if (lfp_options->panel_type > 0xf && >> - lfp_options->panel_type !=3D 0xff) { >> + if (!is_panel_type_valid_or_pnp(lfp_options->panel_type)) { >> drm_dbg_kms(display->drm, "Invalid VBT panel type 0x%x\n", >> lfp_options->panel_type); >> return -1; >> } >>=20=20 >> - if (devdata && devdata->child.handle =3D=3D DEVICE_HANDLE_LFP2) >> + if (devdata && devdata->child.handle =3D=3D DEVICE_HANDLE_LFP2) { >> + if (!is_panel_type_valid_or_pnp(lfp_options->panel_type2)) { >> + drm_dbg_kms(display->drm, "Invalid VBT panel type 2 0x%x\n", >> + lfp_options->panel_type2); >> + return -1; >> + } >> + >> return lfp_options->panel_type2; >> + } > > Hmm, this code will always return 'panel_type' if it's valid, even > for LFP2. That seems wrong, but would need to double check the > Windows behaviour to be sure... > > But that's a separate issue, so this patch is > Reviewed-by: Ville Syrj=C3=A4l=C3=A4 Thanks, pushed to din. BR, Jani. > >>=20=20 >> drm_WARN_ON(display->drm, >> devdata && devdata->child.handle !=3D DEVICE_HANDLE_LFP1); >> @@ -762,13 +783,12 @@ static int get_panel_type(struct intel_display *di= splay, >> panel_types[i].name, panel_types[i].panel_type); >> } >>=20=20 >> - if (panel_types[PANEL_TYPE_OPREGION].panel_type >=3D 0) >> + if (is_panel_type_valid(panel_types[PANEL_TYPE_OPREGION].panel_type)) >> i =3D PANEL_TYPE_OPREGION; >> - else if (panel_types[PANEL_TYPE_VBT].panel_type =3D=3D 0xff && >> - panel_types[PANEL_TYPE_PNPID].panel_type >=3D 0) >> + else if (is_panel_type_pnp(panel_types[PANEL_TYPE_VBT].panel_type) && >> + is_panel_type_valid(panel_types[PANEL_TYPE_PNPID].panel_type)) >> i =3D PANEL_TYPE_PNPID; >> - else if (panel_types[PANEL_TYPE_VBT].panel_type !=3D 0xff && >> - panel_types[PANEL_TYPE_VBT].panel_type >=3D 0) >> + else if (is_panel_type_valid(panel_types[PANEL_TYPE_VBT].panel_type)) >> i =3D PANEL_TYPE_VBT; >> else >> i =3D PANEL_TYPE_FALLBACK; >> --=20 >> 2.47.3 --=20 Jani Nikula, Intel