DF-4122 — No block-size floor for fixed per-panel-array BDB consumers: parse_edp/parse_psr/parse_lfp_backlight read up to ~350 bytes past short blocks

• File: sys/dev/drm/i915/intel_bios.c
• Lines: 569,582-583,681,311-317,331,344 Severity: Medium Confidence: certain
• Status: reproduced (impact: leak) — hardware-gated crafted-VBIOS/firmware threat model; harness-reproduced on the DragonFly guest.

Summary

find_section() (intel_bios.c:77-106) only guarantees a located block's DECLARED size fits within bdb_size; it does not check the block is large enough for the struct parsed from it. A crafted VBT can declare BDB_EDP, BDB_PSR or BDB_LVDS_BACKLIGHT with a size of 0..N bytes smaller than the struct, so: - parse_edp (intel_bios.c:569) reads edp->color_depth at +160 and &edp->power_seqs[panel_type] (:582, +150 for panel_type 15) and fast_link_params[panel_type] (:583, up to +196) from a block that may be 1 byte -> reads past the bdb end; - parse_psr (:681) reads psr_table[panel_type] (up to +96) the same way; - parse_lfp_backlight (:311 entry_size, :317 data[panel_type], :344 level[panel_type]) — only the version>=191 extension is guarded (get_blocksize >= sizeof(*backlight_data) at :327-328), which proves the pattern was known but never applied to the other reads; - parse_sdvo_panel_data (:370) and parse_general_features/parse_driver_features scalar reads share the pattern. When the short block is the last one and bdb_size spans to the end of the validated buffer, these are OOB reads past the kmemdup'd i915_vbt_firmware heap allocation (exact-size kmemdup at intel_opregion.c:942) or past the opregion RVDA mapping (pmap_mapbios(rvda, rvds), intel_opregion.c:1031).

Reproduce (harness)

./build.sh && ./run.sh — exit 77 = OOB/div0 confirmed by verbatim kernel code; -p run = proposed fix, exit 0.

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

DF-4122 verdict — No block-size floor for fixed per-panel-array BDB consumers: parse_edp/parse_psr/parse_lfp_backlight read up to ~350 bytes past short blocks

Reproduced? — reproduced (leak)

Harness-reproduced (edp instance): a 74-byte crafted VBT, accepted by the verbatim intel_bios_is_valid_vbt(), declares BDB_EDP as the last block with size 1. The verbatim parse_edp read of edp->color_depth (+160) and power_seqs[panel_type] hits the guard page — SIGSEGV at +233 from the buffer base, exit 77, stable across 3 runs. parse_psr (:681) and parse_lfp_backlight (:317/:344) have the identical shape (per-panel arrays with no floor). Hardware/firmware-gated (crafted-VBT model), same class as the block-size validation upstream later added across these parsers.

Root cause (path:line)

find_section() (intel_bios.c:77-106) only guarantees a located block's DECLARED size fits within bdb_size; it does not check the block is large enough for the struct parsed from it. A crafted VBT can declare BDB_EDP, BDB_PSR or BDB_LVDS_BACKLIGHT with a size of 0..N bytes smaller than the struct, so: - parse_edp (intel_bios.c:569) reads edp->color_depth at +160 and &edp->power_seqs[panel_type] (:582, +150 for panel_type 15) and fast_link_params[panel_type] (:583, up to +196) from a block that may be 1 byte -> reads past the bdb end; - parse_psr (:681) reads psr_table[panel_type] (up to +96) the same way; - parse_lfp_backlight (:311 entry_size, :317 data[panel_type], :344 level[panel_type]) — only the version>=191 extension is guarded (get_blocksize >= sizeof(*backlight_data) at :327-328), which proves the pattern was known but never applied to the other reads; - parse_sdvo_panel_data (:370) and parse_general_features/parse_driver_features scalar reads share the pattern. When the short block is the last one and bdb_size spans to the end of the validated buffer, these are OOB reads past the kmemdup'd i915_vbt_firmware heap allocation (exact-size kmemdup at intel_opregion.c:942) or past the opregion RVDA mapping (pmap_mapbios(rvda, rvds), intel_opregion.c:1031).

Chain

crafted VBT with short BDB_EDP/BDB_PSR/BDB_LVDS_BACKLIGHT as last block -> find_section accepts any declared size that fits bdb -> parse_edp/parse_psr/parse_lfp_backlight struct reads run past bdb end -> OOB read past heap (firmware VBT) or mapping (opregion/ROM)

Kernel refs

• sys/dev/drm/i915/intel_bios.c:569
• sys/dev/drm/i915/intel_bios.c:582
• sys/dev/drm/i915/intel_bios.c:681
• sys/dev/drm/i915/intel_bios.c:317
• sys/dev/drm/i915/intel_bios.c:327
• sys/dev/drm/i915/intel_bios.c:344
• sys/dev/drm/i915/intel_bios.c:96
• sys/dev/drm/i915/intel_opregion.c:942
• sys/dev/drm/i915/intel_opregion.c:1031

Fix

Fail-closed floors matching exactly what each parser reads unconditionally (upstream later did the same across these blocks). Harness -p mode implements the edp floor (164) and rejects the 1-byte block without any struct read (fix_run.log).

fix.diff applies cleanly against the read-only sys/ tree (2-file for DF-4125; note the radeon_pm.c hunk also needs dpm_failed_unlock: mutex_unlock(&rdev->pm.mutex); added to the existing dpm_failed label path — spelled out here since the label does not exist in the unfixed tree). Kernel-level fix validation is not possible on this guest (no i915/RV6xx devices; the drivers never attach in QEMU); harness-level fix validation IS included: the -p runs exercise the patched parse logic against the identical crafted input and exit 0 (fix_run.log).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.