Re: [PATCH v12 3/8] drm/i915/bios: print VS/PE-O port info

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing validation of VBT block size for flexible array `tables`.
--

commit 5baf963f5f945def9cd11d658adeeb946a342be0
Author: Michał Grzelak <michal.grzelak@intel.com>
Date:   Fri Sep 4 12:31:43 2026 +0000

    drm/i915/bios: print VS/PE-O port info
    
    Issue a debug message when port asks to override default Vswing /
    Preemphasis tables. Add helper intel_bios_encoder_requests_vspeo()
    to check if port requests for overriding default VS/PE tables.

> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
> index 06a8dd7581bb8..9610b794bc147 100644
> --- a/drivers/gpu/drm/i915/display/intel_bios.c
> +++ b/drivers/gpu/drm/i915/display/intel_bios.c
> @@ -2801,6 +2801,11 @@ static void print_ddi_port(const struct intel_bios_encoder_data *devdata)
>  			    "Port %c supports dynamic DDI allocation in TCSS\n",
>  			    port_name(port));
>  
> +	if (intel_bios_encoder_requests_vspeo(devdata))
> +		drm_dbg_kms(display->drm,
> +			    "Port %c requests vswing/pre-emphasis override\n",
> +			    port_name(port));
> +

[Severity: High]
This isn't a bug introduced by this patch, but since this patch and the
overall series rely on the VS/PE-O tables, I noticed a pre-existing issue in
parse_vswing_preemph_override() where we assign the tables array without
validating the VBT block size:

drivers/gpu/drm/i915/display/intel_bios.c:parse_vswing_preemph_override() {
    ...
    block = bdb_find_section(display, BDB_VSWING_PREEMPH);
    if (!block)
        return;

    display->vbt.vspeo.tables = block->tables;
    display->vbt.vspeo.num_tables = block->num_tables;
    display->vbt.vspeo.num_columns = block->num_columns;
    ...
}

Does this code need to call get_blocksize(block) and verify that the block
size is large enough to contain the tables flexible array based on
num_tables, num_rows, and num_columns?

Without this check, if a malformed VBT specifies a small block size (e.g.
num_tables is 0), subsequent patches in this series that access hardcoded
table indices (like idx = 5 for C20 DP 2.0 in intel_bios_get_c20_vspeo)
could perform an out-of-bounds read of the VBT allocation buffer.

Could this out-of-bounds read hit an unmapped page and cause a kernel panic
during boot, or silently corrupt the PHY configuration by reading garbage
memory? This latent issue appears to stem from the earlier patch
drm/i915/bios: store VBT #57's metadata in intel_vbt_data in this series.

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904123148.2165596-1-michal.grzelak@intel.com?part=3