[PATCH] ACPI: video: reject out-of-range _BQC indexes

[Kang Chen]

acpi_video_bqc_value_to_level() indexes brightness->levels[] with the
value returned by _BQC once the index quirk has been armed, but does
not verify that the value is inside the array.  A firmware that behaves
consistently during the quirk detection and then returns a large value
can make the driver read out of bounds; the reversed branch also
underflows before indexing.

Return an invalid level when the index is out of range, so that the
existing callers disable _BQC.  Also guard against a brightness table
with no usable levels, and tighten the range check in the quirk
detection before its reversed subtraction.

Fixes: 994fa63c5b12 ("ACPI / video: Fix applying indexed initial brightness value.")
Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>
---
 drivers/acpi/acpi_video.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
index 2a2822516665..44af7ffb9a81 100644
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -533,6 +533,13 @@ acpi_video_bqc_value_to_level(struct acpi_video_device *device,
 		 * items with special meaning (see enum acpi_video_level_idx),
 		 * so we need to compensate for that by offsetting ourselves
 		 */
+		if (device->brightness->count <= ACPI_VIDEO_FIRST_LEVEL)
+			return U64_MAX;
+
+		if (bqc_value >= device->brightness->count -
+				 ACPI_VIDEO_FIRST_LEVEL)
+			return U64_MAX;
+
 		if (device->brightness->flags._BCL_reversed)
 			bqc_value = device->brightness->count -
 				ACPI_VIDEO_FIRST_LEVEL - 1 - bqc_value;
@@ -781,7 +788,7 @@ static int acpi_video_bqc_quirk(struct acpi_video_device *device,
 
 	if (level != test_level) {
 		/* buggy _BQC found, need to find out if it uses index */
-		if (level < br->count) {
+		if (level < br->count - ACPI_VIDEO_FIRST_LEVEL) {
 			if (br->flags._BCL_reversed)
 				level = br->count - ACPI_VIDEO_FIRST_LEVEL - 1 - level;
 			if (br->levels[level + ACPI_VIDEO_FIRST_LEVEL] == test_level)
-- 
2.34.1