bxt_setup_backlight uses VBT-derived controller 0-15 without bounds check for OOB MMIO offset
Summary
bxt_setup_backlight at intel_panel.c:1674: panel->backlight.controller=vbt.backlight.controller (u8:4 bitfield 0-15). BXT_BLC_PWM_CTL(c)=0xC8250+c*0x100 only valid c=0,1. c>=2 -> undefined MMIO offset read/written throughout file. VBT from GPU BIOS/OpROM. Fix: validate controller<=1 in bxt_setup_backlight.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1412 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 828 B | ↓ raw |
DF-1412 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
bxt_setup_backlight uses VBT-derived controller 0-15 without bounds check for OOB MMIO offset
Source Location
sys/dev/drm/i915/intel_panel.c:1674-518
Verdict
Source-confirmed (complex fix): bxt_setup_backlight uses VBT-derived controller 0-15 without bounds ch. No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
bxt_setup_backlight at intel_panel.c:1674: panel->backlight.controller=vbt.backlight.controller (u8:4 bitfield 0-15). BXT_BLC_PWM_CTL(c)=0xC8250+c*0x100 only valid c=0,1. c>=2 -> undefined MMIO offset read/written throughout file. VBT from GPU BIOS/OpROM. Fix: validate controller<=1 in bxt_setup_backlight.
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: bxt_setup_backlight uses VBT-derived controller 0-15 without bounds check for OOB MMIO offset. Complex fix. HW-gated.
Verified recommended fix
Source-confirmed: bxt_setup_backlight uses VBT-derived controller 0-15 without bounds check for OOB MMIO offset. Complex fix. HW-gated.
Verdict
Source-confirmed: bxt_setup_backlight uses VBT-derived controller 0-15 without bounds check for OOB MMIO offset. Complex fix. HW-gated.
No comments yet.