* Re: [PATCH] drm/i915/bios: range check LFP Data Block panel_type2
2026-06-25 13:51 [PATCH] drm/i915/bios: range check LFP Data Block panel_type2 Jani Nikula
@ 2026-06-25 15:27 ` Michał Grzelak
2026-06-26 13:37 ` Ville Syrjälä
2026-06-26 14:01 ` [PATCH v2] " Jani Nikula
2 siblings, 0 replies; 4+ messages in thread
From: Michał Grzelak @ 2026-06-25 15:27 UTC (permalink / raw)
To: Jani Nikula
Cc: intel-gfx, intel-xe, Martin Hodo, stable, Animesh Manna,
Ville Syrjälä
[-- Attachment #1: Type: text/plain, Size: 3348 bytes --]
On Thu, 25 Jun 2026, Jani Nikula wrote:
> While the panel_type from LFP Data Block is range checked, panel_type2
> is not. Add a few helpers for range checking, and use them to not only
> check panel_type2, but also imrove clarity and correctness in the panel
typo: s/imrove/improve/
> type selection.
>
> Discovered using AI-assisted static analysis confirmed by Intel Product
> Security.
>
> Reported-by: Martin Hodo <martin.hodo@intel.com>
> Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child device index in VBT")
> Cc: <stable@vger.kernel.org> # v6.0+
> Cc: Animesh Manna <animesh.manna@intel.com>
> Cc: Ville Syrjälä <ville.syrjala@intel.com>
> Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
BR,
Michał
> ---
> drivers/gpu/drm/i915/display/intel_bios.c | 29 +++++++++++++++++------
> 1 file changed, 22 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
> index 15ebadc72b88..0c420019e46a 100644
> --- a/drivers/gpu/drm/i915/display/intel_bios.c
> +++ b/drivers/gpu/drm/i915/display/intel_bios.c
> @@ -623,6 +623,16 @@ get_lfp_data_tail(const struct bdb_lfp_data *data,
> return NULL;
> }
>
> +static bool is_panel_type_valid(int panel_type)
> +{
> + return panel_type >= 0 && panel_type < 16;
> +}
> +
> +static bool is_panel_type_valid_or_pnp(int panel_type)
> +{
> + return is_panel_type_valid(panel_type) || panel_type == 0xff;
> +}
> +
> static int opregion_get_panel_type(struct intel_display *display,
> const struct intel_bios_encoder_data *devdata,
> const struct drm_edid *drm_edid, bool use_fallback)
> @@ -640,15 +650,21 @@ static int vbt_get_panel_type(struct intel_display *display,
> if (!lfp_options)
> return -1;
>
> - if (lfp_options->panel_type > 0xf &&
> - lfp_options->panel_type != 0xff) {
> + if (!is_panel_type_valid_or_pnp(lfp_options->panel_type)) {
> drm_dbg_kms(display->drm, "Invalid VBT panel type 0x%x\n",
> lfp_options->panel_type);
> return -1;
> }
>
> - if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2)
> + if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2) {
> + if (!is_panel_type_valid_or_pnp(lfp_options->panel_type2)) {
> + drm_dbg_kms(display->drm, "Invalid VBT panel type 2 0x%x\n",
> + lfp_options->panel_type2);
> + return -1;
> + }
> +
> return lfp_options->panel_type2;
> + }
>
> drm_WARN_ON(display->drm,
> devdata && devdata->child.handle != DEVICE_HANDLE_LFP1);
> @@ -762,13 +778,12 @@ static int get_panel_type(struct intel_display *display,
> panel_types[i].name, panel_types[i].panel_type);
> }
>
> - if (panel_types[PANEL_TYPE_OPREGION].panel_type >= 0)
> + if (is_panel_type_valid(panel_types[PANEL_TYPE_OPREGION].panel_type))
> i = PANEL_TYPE_OPREGION;
> else if (panel_types[PANEL_TYPE_VBT].panel_type == 0xff &&
> - panel_types[PANEL_TYPE_PNPID].panel_type >= 0)
> + is_panel_type_valid(panel_types[PANEL_TYPE_PNPID].panel_type))
> i = PANEL_TYPE_PNPID;
> - else if (panel_types[PANEL_TYPE_VBT].panel_type != 0xff &&
> - panel_types[PANEL_TYPE_VBT].panel_type >= 0)
> + else if (is_panel_type_valid(panel_types[PANEL_TYPE_VBT].panel_type))
> i = PANEL_TYPE_VBT;
> else
> i = PANEL_TYPE_FALLBACK;
> --
> 2.47.3
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] drm/i915/bios: range check LFP Data Block panel_type2
2026-06-25 13:51 [PATCH] drm/i915/bios: range check LFP Data Block panel_type2 Jani Nikula
2026-06-25 15:27 ` Michał Grzelak
@ 2026-06-26 13:37 ` Ville Syrjälä
2026-06-26 14:01 ` [PATCH v2] " Jani Nikula
2 siblings, 0 replies; 4+ messages in thread
From: Ville Syrjälä @ 2026-06-26 13:37 UTC (permalink / raw)
To: Jani Nikula
Cc: intel-gfx, intel-xe, Martin Hodo, stable, Animesh Manna,
Ville Syrjälä
On Thu, Jun 25, 2026 at 04:51:30PM +0300, Jani Nikula wrote:
> While the panel_type from LFP Data Block is range checked, panel_type2
> is not. Add a few helpers for range checking, and use them to not only
> check panel_type2, but also imrove clarity and correctness in the panel
> type selection.
>
> Discovered using AI-assisted static analysis confirmed by Intel Product
> Security.
>
> Reported-by: Martin Hodo <martin.hodo@intel.com>
> Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child device index in VBT")
> Cc: <stable@vger.kernel.org> # v6.0+
> Cc: Animesh Manna <animesh.manna@intel.com>
> Cc: Ville Syrjälä <ville.syrjala@intel.com>
> Signed-off-by: Jani Nikula <jani.nikula@intel.com>
> ---
> drivers/gpu/drm/i915/display/intel_bios.c | 29 +++++++++++++++++------
> 1 file changed, 22 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
> index 15ebadc72b88..0c420019e46a 100644
> --- a/drivers/gpu/drm/i915/display/intel_bios.c
> +++ b/drivers/gpu/drm/i915/display/intel_bios.c
> @@ -623,6 +623,16 @@ get_lfp_data_tail(const struct bdb_lfp_data *data,
> return NULL;
> }
>
> +static bool is_panel_type_valid(int panel_type)
> +{
> + return panel_type >= 0 && panel_type < 16;
> +}
> +
> +static bool is_panel_type_valid_or_pnp(int panel_type)
> +{
> + return is_panel_type_valid(panel_type) || panel_type == 0xff;
> +}
> +
> static int opregion_get_panel_type(struct intel_display *display,
> const struct intel_bios_encoder_data *devdata,
> const struct drm_edid *drm_edid, bool use_fallback)
> @@ -640,15 +650,21 @@ static int vbt_get_panel_type(struct intel_display *display,
> if (!lfp_options)
> return -1;
>
> - if (lfp_options->panel_type > 0xf &&
> - lfp_options->panel_type != 0xff) {
> + if (!is_panel_type_valid_or_pnp(lfp_options->panel_type)) {
> drm_dbg_kms(display->drm, "Invalid VBT panel type 0x%x\n",
> lfp_options->panel_type);
> return -1;
> }
>
> - if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2)
> + if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2) {
> + if (!is_panel_type_valid_or_pnp(lfp_options->panel_type2)) {
> + drm_dbg_kms(display->drm, "Invalid VBT panel type 2 0x%x\n",
> + lfp_options->panel_type2);
> + return -1;
> + }
> +
> return lfp_options->panel_type2;
> + }
>
> drm_WARN_ON(display->drm,
> devdata && devdata->child.handle != DEVICE_HANDLE_LFP1);
> @@ -762,13 +778,12 @@ static int get_panel_type(struct intel_display *display,
> panel_types[i].name, panel_types[i].panel_type);
> }
>
> - if (panel_types[PANEL_TYPE_OPREGION].panel_type >= 0)
> + if (is_panel_type_valid(panel_types[PANEL_TYPE_OPREGION].panel_type))
> i = PANEL_TYPE_OPREGION;
> else if (panel_types[PANEL_TYPE_VBT].panel_type == 0xff &&
is_panel_type_pnp()?
> - panel_types[PANEL_TYPE_PNPID].panel_type >= 0)
> + is_panel_type_valid(panel_types[PANEL_TYPE_PNPID].panel_type))
> i = PANEL_TYPE_PNPID;
> - else if (panel_types[PANEL_TYPE_VBT].panel_type != 0xff &&
> - panel_types[PANEL_TYPE_VBT].panel_type >= 0)
> + else if (is_panel_type_valid(panel_types[PANEL_TYPE_VBT].panel_type))
> i = PANEL_TYPE_VBT;
> else
> i = PANEL_TYPE_FALLBACK;
> --
> 2.47.3
--
Ville Syrjälä
Intel
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH v2] drm/i915/bios: range check LFP Data Block panel_type2
2026-06-25 13:51 [PATCH] drm/i915/bios: range check LFP Data Block panel_type2 Jani Nikula
2026-06-25 15:27 ` Michał Grzelak
2026-06-26 13:37 ` Ville Syrjälä
@ 2026-06-26 14:01 ` Jani Nikula
2 siblings, 0 replies; 4+ messages in thread
From: Jani Nikula @ 2026-06-26 14:01 UTC (permalink / raw)
To: Jani Nikula, intel-gfx, intel-xe
Cc: Martin Hodo, stable, Animesh Manna, Ville Syrjälä,
Michał Grzelak
While the panel_type from LFP Data Block is range checked, panel_type2
is not. Add a few helpers for range checking, and use them to not only
check panel_type2, but also improve clarity and correctness in the panel
type selection.
Discovered using AI-assisted static analysis confirmed by Intel Product
Security.
v2:
- Fix commit message typo (Michał)
- Add is_panel_type_pnp() (Ville)
Reported-by: Martin Hodo <martin.hodo@intel.com>
Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child device index in VBT")
Cc: <stable@vger.kernel.org> # v6.0+
Cc: Animesh Manna <animesh.manna@intel.com>
Cc: Ville Syrjälä <ville.syrjala@intel.com>
Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> # v1
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
---
drivers/gpu/drm/i915/display/intel_bios.c | 36 ++++++++++++++++++-----
1 file changed, 28 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index 15ebadc72b88..97cbae2e547e 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -623,6 +623,21 @@ get_lfp_data_tail(const struct bdb_lfp_data *data,
return NULL;
}
+static bool is_panel_type_valid(int panel_type)
+{
+ return panel_type >= 0 && panel_type < 16;
+}
+
+static bool is_panel_type_pnp(int panel_type)
+{
+ return panel_type == 0xff;
+}
+
+static bool is_panel_type_valid_or_pnp(int panel_type)
+{
+ return is_panel_type_valid(panel_type) || is_panel_type_pnp(panel_type);
+}
+
static int opregion_get_panel_type(struct intel_display *display,
const struct intel_bios_encoder_data *devdata,
const struct drm_edid *drm_edid, bool use_fallback)
@@ -640,15 +655,21 @@ static int vbt_get_panel_type(struct intel_display *display,
if (!lfp_options)
return -1;
- if (lfp_options->panel_type > 0xf &&
- lfp_options->panel_type != 0xff) {
+ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type)) {
drm_dbg_kms(display->drm, "Invalid VBT panel type 0x%x\n",
lfp_options->panel_type);
return -1;
}
- if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2)
+ if (devdata && devdata->child.handle == DEVICE_HANDLE_LFP2) {
+ if (!is_panel_type_valid_or_pnp(lfp_options->panel_type2)) {
+ drm_dbg_kms(display->drm, "Invalid VBT panel type 2 0x%x\n",
+ lfp_options->panel_type2);
+ return -1;
+ }
+
return lfp_options->panel_type2;
+ }
drm_WARN_ON(display->drm,
devdata && devdata->child.handle != DEVICE_HANDLE_LFP1);
@@ -762,13 +783,12 @@ static int get_panel_type(struct intel_display *display,
panel_types[i].name, panel_types[i].panel_type);
}
- if (panel_types[PANEL_TYPE_OPREGION].panel_type >= 0)
+ if (is_panel_type_valid(panel_types[PANEL_TYPE_OPREGION].panel_type))
i = PANEL_TYPE_OPREGION;
- else if (panel_types[PANEL_TYPE_VBT].panel_type == 0xff &&
- panel_types[PANEL_TYPE_PNPID].panel_type >= 0)
+ else if (is_panel_type_pnp(panel_types[PANEL_TYPE_VBT].panel_type) &&
+ is_panel_type_valid(panel_types[PANEL_TYPE_PNPID].panel_type))
i = PANEL_TYPE_PNPID;
- else if (panel_types[PANEL_TYPE_VBT].panel_type != 0xff &&
- panel_types[PANEL_TYPE_VBT].panel_type >= 0)
+ else if (is_panel_type_valid(panel_types[PANEL_TYPE_VBT].panel_type))
i = PANEL_TYPE_VBT;
else
i = PANEL_TYPE_FALLBACK;
--
2.47.3
^ permalink raw reply related [flat|nested] 4+ messages in thread